Architecting Dependable Systems Vi 1st Edition Ricardo Jimenezperis

Architecting Dependable Systems Vi 1st Edition
Ricardo Jimenezperis download
https://ebookbell.com/product/architecting-dependable-systems-
vi-1st-edition-ricardo-jimenezperis-2023342
Explore and download more ebooks at ebookbell.com

Here are some recommended products that we believe you will be
interested in. You can click the link to download.
Architecting Dependable Systems Vii 1st Edition Themistoklis Bourdenas
https://ebookbell.com/product/architecting-dependable-systems-vii-1st-
edition-themistoklis-bourdenas-2022710
Architecting Dependable Systems Vii 1st Edition Themistoklis Bourdenas
https://ebookbell.com/product/architecting-dependable-systems-vii-1st-
edition-themistoklis-bourdenas-4140684
Architecting Dependable Systems V 1st Edition Paulo Verssimo
https://ebookbell.com/product/architecting-dependable-systems-v-1st-
edition-paulo-verssimo-11848662
Architecting Dependable Systems Iv 1st Edition Joyce L Tokar Auth
https://ebookbell.com/product/architecting-dependable-systems-iv-1st-
edition-joyce-l-tokar-auth-4240002

Architecting Dependable Systems 1st Edition Paulo Esteves Verssimo
https://ebookbell.com/product/architecting-dependable-systems-1st-
edition-paulo-esteves-verssimo-1184834
Architecting Dependable Systems Iii 1st Edition Nikolaos Georgantas
https://ebookbell.com/product/architecting-dependable-systems-iii-1st-
edition-nikolaos-georgantas-1225972
Architecting Dependable Systems Ii 1st Edition Michel Wermelinger
https://ebookbell.com/product/architecting-dependable-systems-ii-1st-
edition-michel-wermelinger-1532742
Dependable Iot For Human And Industry Modeling Architecting
Implementation Vyacheslav Kharchenko
https://ebookbell.com/product/dependable-iot-for-human-and-industry-
modeling-architecting-implementation-vyacheslav-kharchenko-11052240
Architecting A Knowledgebased Platform For Design Engineering 40
Zhenjun Ming
https://ebookbell.com/product/architecting-a-knowledgebased-platform-
for-design-engineering-40-zhenjun-ming-46703900

Lecture Notes in Computer Science 5835
Commenced Publication in 1973
Founding and Former Series Editors:
Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen
Editorial Board
David Hutchison
Lancaster University, UK
Takeo Kanade
Carnegie Mellon University, Pittsburgh, PA, USA
Josef Kittler
University of Surrey, Guildford, UK
Jon M. Kleinberg
Cornell University, Ithaca, NY, USA
Alfred Kobsa
University of California, Irvine, CA, USA
Friedemann Mattern
ETH Zurich, Switzerland
John C. Mitchell
Stanford University, CA, USA
Moni Naor
Weizmann Institute of Science, Rehovot, Israel
Oscar Nierstrasz
University of Bern, Switzerland
C. Pandu Rangan
Indian Institute of Technology, Madras, India
Bernhard Steffen
University of Dortmund, Germany
Madhu Sudan
Microsoft Research, Cambridge, MA, USA
Demetri Terzopoulos
University of California, Los Angeles, CA, USA
Doug Tygar
University of California, Berkeley, CA, USA
Gerhard Weikum
Max-Planck Institute of Computer Science, Saarbruecken, Germany

Rogério de Lemos Jean-Charles Fabre
Cristina Gacek Fabio Gadducci
Maurice ter Beek (Eds.
Architecting
Dependable
SystemsVI
13

Volume Editors
Rogério de Lemos
University of Kent, Computing Laboratory
Canterbury, Kent CT2 7NF, UK
E-mail: [email protected]
Jean-Charles Fabre
LAAS-CNRS
7, avenue du Colonel Roche, 31077 Toulouse Cedex 4, France
E-mail: [email protected]
Cristina Gacek
Newcastle University, School of Computing Science
Newcastle upon Tyne, NE1 7RU, UK
E-mail: [email protected]
Fabio Gadducci
Università di Pisa, Dipartimento di Informatica
Largo Pontecorvo 3c, 56127 Pisa, Italy
E-mail: [email protected]
Maurice ter Beek
Istituto di Scienza e Tecnologie dell’Informazione (ISTI-CNR
Area della Ricerca di Pisa, Via G. Moruzzi 1, 56124 Pisa, Italy
E-mail: [email protected]
Library of Congress Control Number: 2009937881
CR Subject Classiﬁcation (1998
LNCS Sublibrary: SL 2 – Programming and Software Engineering
ISSN 0302-9743
ISBN-10 3-642-10247-6 Springer Berlin Heidelberg New York
ISBN-13 978-3-642-10247-9 Springer Berlin Heidelberg New York
This work is subject to copyright. All rights are reserved, whether the whole or part of the material is
concerned, speciﬁcally the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting,
reproduction on microﬁlms or in any other way, and storage in data banks. Duplication of this publication
or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965,
in its current version, and permission for use must always be obtained from Springer. Violations are liable
to prosecution under the German Copyright Law.
springer.com
© Springer-Verlag Berlin Heidelberg 2009
Printed in Germany
Typesetting: Camera-ready by author, data conversion by Scientiﬁc Publishing Services, Chennai, India
Printed on acid-free paper SPIN: 12780082 06/3180 543210

Foreword
The challenges that arise from building and running large enterprise applications
are among the most daunting and underappreciated in computer science today.
Such applications are invariably large, with millions of lines of code. They are
often executed on multiple machines that may be located in diﬀerent geographic
areas and connected by networks of various speeds and capabilities, leading to
issues related to distribution, concurrency, and networking. Given the impor-
tance of these applications to the ﬁnancial health and stability of the compa-
nies involved, the requirements related to dependability—reliability, availability,
timeliness, security—are also often strict. Finally, applications from one enter-
prise increasingly need to interoperate programmatically in a seamless fashion
with applications from other companies to support business-to-business (B2B)
transactions, whether with suppliers, customers, or peers. In short, enterprise
applications are diﬃcult to construct, operate, and maintain, yet are a critical
part of the world’s economic infrastructure.
This volume brings together the eﬀorts of researchers from the dependabil-
ity and software architecture communities to address issues important for solv-
ing the dependability challenges of enterprise applications. The ﬁrst group of
papers deals with dependability in the context of the service-oriented architec-
ture (SOA) structuring paradigm. With an SOA, software functionality in a
distributed system is structured as collections of interacting services, possibly
operated by diﬀerent companies or otherwise in distinct administrative domains.
The services include both infrastructure services, such as directory services, mon-
itoring, and resource allocation services, as well as application services that
implement some application-speciﬁc functions. A given service is usually rep-
resented by one or more published interfaces, which allow other services to ﬁnd
and access it dynamically at runtime. In their pure form, SOAs oﬀer fundamen-
tal characteristics that can simplify the construction and operation of enterprise
applications, including support for dynamic operation, long-term software evo-
lution, extensibility, and composibility.
While SOAs are potentially a useful way to address some of the issues that
surround enterprise applications, they are not a panacea and in many ways
merely reorient the inherent problems in this domain into a new perspective.
This observation does not diminish their value, however, since it is often the
viewing of existing challenges through a new lens that leads to the creation
of new abstractions, techniques, and methodologies. This is especially true for
dependability attributes, which are notoriously diﬃcult to ensure in large het-
erogeneous distributed systems like those for which SOAs are intended. In this
context, SOAs and their related technologies are important and timely topics
that need to be addressed by the research community, and it is indeed fortunate
to have collected here a number of papers that do just that.

VI Foreword
The second group of papers addresses issues related to the evaluation of sys-
tems with critical dependability attributes. Evaluation is, of course, a key step
for any system, but it is especially important for enterprise applications given
their economic importance and strict dependability requirements. Bringing to
bear tools and techniques from both the dependability and architecture commu-
nities is a good starting point for developing approaches that can eventually scale
to the size and complexity of collections of interacting enterprise applications.
The ﬁnal group of papers focuses on architecting security. The importance
of this attribute for enterprise applications cannot be underestimated, and it
is arguably the foundational element for any type of enterprise-oriented sys-
tem. Without guarantees related to privacy, authentication, integrity and simi-
lar properties, it is impossible to interact with customers, suppliers, or peers in
any kind of rational and safe way. Again, the application of architectural prin-
ciples from software engineering coupled with dependability techniques provide
a compelling vantage point from which to make progress.
As is clear from the above, perhaps themost unique aspect of this collection
of papers is how it represents the best ideas from research in both software
architectures and dependability. It is refreshing to see two traditionally separate
communities coming together to address problems notonly of common interest,
but also of critical importance to society. The dependability issues associated
with enterprise applications are deep and challenging, and the papers in this
collection are indeed a welcome addition to the literature in this area.
August 2009 Rick Schlichting
AT&T Labs – Research

Preface

This is the sixth book in a series on Architecting Dependable Systems. This series
started seven years ago, and brings together issues related to software architectures
and the dependability and security of systems. This book includes expanded and peer-
reviewed papers based on the selected contributions to two workshops, and a number
of invited papers written by recognized experts in the area. The two workshops were:
the Workshop on Architecting Dependable Systems (WADS) organized at the 2008
International Conference on Dependable Systems and Networks (DSN 2008), and the
Third International Workshop on Views On Designing Complex Architectures
(VODCA 2008).
Identification of the system structure (i.e., architecture) early in its development
process makes it easier for the developers to make crucial decisions about system
properties and to justify them before moving to the design or implementation stages.
Moreover, the architectural level views support abstracting away from details of the
system, thus facilitating the understanding of broader system concerns. One of the
benefits of a well-structured system is the reduction of its overall complexity, which
in turn leads to a more dependable and secure system. System dependability is de-
fined as the reliance that can be justifiably placed on the service delivered by the
system, while security can be defined as protecting the system and certain information
it contains from unauthorized access and handling. Both have become essential as-
pects of computer systems as everyday life increasingly depends on software. It is
therefore a matter of concern that dependability and security issues are usually left
until too late in the process of system development.
Making decisions and reasoning about structure happen at different levels of ab-
straction throughout the software development cycle. Reasoning about dependability
at the architectural level has recently been in the focus of researchers and practitioners
because of the complexity of emerging applications. From the perspective of software
engineering, traditionally striving to build software systems that are fault free, archi-
tectural consideration of dependability requires the acceptance of the fact that system
models need to reflect that it is impossible to avoid or foresee all faults. This requires
novel notations, methods and techniques providing the necessary support for reason-
ing about faults (including fault avoidance, fault tolerance, fault removal and fault
forecasting) at the architectural level. Moreover, due to the inherent design trade-off
between dependability and security attributes, security issues should also be taken
into account at the architectural level.
This book comes as a result of bringing together research communities of software
architectures, dependability and security, and addresses issues that are currently rele-
vant to improving the state of the art in architecting dependable and secure systems.
The book consists of three parts: Dependable Service-Oriented Architectures, Fault
Tolerance and System Evaluation, and Architecting Security.
The first part entitled “Dependable Service-Oriented Architectures” includes five
papers focusing on various aspects on how to design dependable service-oriented

Preface VIII
systems. The first paper of this part, authored by R. Jimenez-Peris, M. Patiño-
Martinez, B. Kemme, F. Perez-Sorrosal and D. Serrano, and entitled “A System of
Architectural Patterns for Scalable, Consistent and Highly Available Multitier
Service-Oriented Infrastructure” describes how, in the context of service-oriented
architectures, replication can be performed across a multi-tier architecture in order to
satisfy the high availability, consistency and/or scalability requirements. These archi-
tectural patterns can guide system architects and practitioners in evaluating and
selecting the appropriate architectural choices in order to replicate multi-tier software
infrastructures.
V. Cardellini, E. Casalicchio, V. Grassi, F. Lo Presti and R. Mirandola contribute
to the book with the paper “Towards Self-Adaptation for Dependable Service Ori-
ented Systems.” This paper proposes a model-based approach to the realization of
self-adaptable systems adopting the service-oriented architecture (SOA) paradigm,
aimed at the fulfilment of dependability requirements. It introduces a methodology
driving the system adaptation highlighting the architectural issues related to its im-
plementation. This is achieved by means of the presentation of a possible architecture
for this type of systems, which can be seen as an instantiation for the SOA environ-
ment of the general architectural framework for self-adapting systems proposed
within the autonomic computing initiative. Given this architecture, the focus is then
on determining suitable adaptation actions in response to detected environmental
changes.
M. P. Machulak, S. E. Parkin, and A. van Moorsel contribute to the book with the
paper “Architecting Dependable Access Control Systems for Multi-Domain Comput-
ing Environments.” This paper reviews the state of the art in requirements analysis for
authorization mechanisms in highly distributed multi-domain computing environ-
ments, focussing in particular on environments that are built on SOAs that interact
through Web Services. This analysis provides a comprehensive insight into both ex-
isting and future authorization mechanisms.
The fourth paper, written by S. Bistarelli and F. Santini, is entitled “Soft Constraints
for Dependable Service-Oriented Architectures.” The paper aims at extending quality of
service measures of SOAs with aspects of dependability. The challenge is to represent
(as well as evaluate and improve) dependability as an architectural feature, rather than
an implementation property. The key idea of the paper is to use the soft constraint
framework (extending the classical constraint notions) in order to be able to manage
SOAs in a declarative fashion by considering together the requirements/interfaces of
each service and their dependability estimation.
The final paper of this part, entitled “Robustness Validation in Service-Oriented
Architectures” and written by N. Laranjeiro, M. Vieira and H. Madeira, addresses the
problem of robustness validation in SOA environments. It builds on previous work to
provide a generic approach for the definition of robustness benchmarks for service
based environments. The approach proposed is based on a set of robustness tests that
is used to discover both programming and design errors. The paper is grounded by an
illustration using two concrete examples, one focusing on Web services and the other
targeting Java Message Service (JMS) middleware.
The second part of this book is entitled “Fault Tolerance and System Evaluation”
and contains four papers. The first paper, entitled “A Self-Repair Architecture for
Cluster Systems,” is written by F. Boyer, N. De Palma, O. Gruber, S. Sicard and J.-B.

Preface   IX
Stefani. This paper presents a framework for the construction of self-repairable cluster
systems. Self-repair is achieved in the JADE framework through a combination of
component-based design, reflection and active replication of the management subsys-
tem. This architecture-based management system is able to tolerate partial failures
and allow failed subsystems to be repaired and reinserted without requiring a global
shutdown.
The paper “Handling Software Faults with Redundancy” by A. Carzaniga, A.
Gorla and M. Pezzè present a survey of several techniques for handling software
faults that were developed in the areas of fault tolerance and autonomic computing.
This paper considers the impact of redundancy on the software architecture, and pro-
poses a taxonomy centered on the nature and use of redundancy in software systems.
G. Lenzini, F.  Martinelli, I.  Matteucci, and S. Gnesi contribute to the book with
the paper “A Uniform Approach to Security and Fault-Tolerance Analysis.” The pa-
per moves from the recognition that, while dependability analysis of distributed sys-
tems is dominated by fault-tolerance and security, these two disciplines evolved in
parallel, cross-breeding yet developing tools and techniques separately. Thus, the
authors illustrate how two security analysis techniques, related to partial model check-
ing and to so-called generalized non-interference, can be applied to verify a family of
fault-tolerance properties. Moreover, exploiting previous results concerning the
framework of non interference analysis, some compositional analysis techniques are
shown to be available.
The final paper of this part, entitled “A Comprehensive Exploration of Challenges
in Architecture-Based Reliability Estimation” and written by I. Krka, G. Edwards, L.
Cheung, L. Golubchik and N. Medvidovic, provides guidance for enhancing the exist-
ing architecture-based reliability estimation approaches and motivates the develop-
ment of new techniques. In this direction, the authors have identified three core chal-
lenges in architecture-based reliability estimation: defining a failure model, obtaining
reliability-related parameter estimates, and dealing with the scale and complexity of
modern software. They have outlined each of these challenges, and described promis-
ing solutions to them.
Part three of the book is on “Architecting Security” and includes four papers focus-
ing on security at the architectural level. The first paper, entitled “Weak Behavioral
Equivalences for Verifying Secure and Performance-Aware Component-Based Sys-
tems” and written by A. Aldini and M. Bernardo, proposes a two-phase predictive
methodology whose goal is to balance the trade-off between security and performance
(QoS
to security analysis, while the second phase uses nonfunctional performance analysis.
The methodology is applied to the stochastic process-algebraic architectural descrip-
tion language AEmilia and it is illustrated through its application to a running exam-
ple based on a multilevel security routing system.
The second paper is written by S. Andova, L. P.J. Groenewegen, J. H. S. Ver-
schuren and E. P. de Vink, and entitled “Architecting Security with Paradigm.” This
paper describes a modelling suite for architecting the security protocols of software
designs. The coordination language Paradigm is used to model the collaborating com-
ponents, specifically taking into account the dynamic consistency between the archi-
tectural components. Subsequently a translation into process algebra allows model

Preface X
checking with the state-of-the-art toolset mCRL2. Two case studies illustrate the
approach.
G. Lenzini contributed to the book with the paper “Trust-Based and Context-Aware
Authentication in a Software Architecture for Context and Proximity-Aware Services”.
This paper describes an existing software architecture for trust prediction in the setting
of proximity-Aware services with unobtrusive and context-based authentication capa-
bilities. A user's presence is predicted with a certain level of trust by combining infor-
mation from a sensor network concerning the location of the user's personal devices.
Each sensor is seen as a recommender providing an opinion, which are collected, inter-
preted and weighted by a context management framework. Experiments illustrate the
reliability of the identification and authentication algorithm in a test-case scenario.
The final paper of this part is entitled “Compositional Verification of Architectural
Refactorings” and authored by D. Bisztray, R. Heckel and H. Ehrig. Motivated by the
adoption of model-driven development, the paper presents a methodology for model
refactoring that allows for the preservation of chosen behavioral properties. More
precisely, the authors propose a heuristics for verifying the transformations of UML
architectural models based on a semantic mapping into CSP processes. Suitable con-
ditions are provided, in order to guarantee the correctness of such a method, and the
feasibility of the verification, by requiring that the mapping satisfy certain composi-
tionality properties.
Architecting dependable systems is now a well-recognized area, attracting interest
and contributions from many researchers. We are certain that this book will prove
valuable for both developers designing complex applications and researchers building
techniques supporting this. We are grateful to many people that made this book possi-
ble. Our thanks go to the authors of the contributions for their excellent work, the
DSN 2008 WADS and VODCA 2008 participants for their active participation in the
discussions. We would also like to thank Alfred Hofmann and his team from Springer
for believing in the idea of a series of books on this important topic and for helping us
to get it published. Last but not least, we greatly appreciate the efforts of our review-
ers who have helped us in ensuring the high quality of the contributions. They are
Alessandro Aldini, Suzana Andova, Paris Avgeriou, Roberto Baldoni, Stefano Bis-
tarelli, David Chadwick, Cas Cremers, Erik de Vink, Elisabetta Di Nitto, Jurgen
Doser, Stefania Gnesi, Vincenzo Grassi, Luuk Groenewegen, Lars Grunske, Robert S.
Hanmer, Reiko Heckel, Matthias Hölzl, Ricardo Jimenez-Peri, Jan Jürjens, Gabriele
Lenzini, Henrique Madeira, Fabio Martinelli, John D. McGregor, Neno Medvidovic,
Veena B. Mendiratta, Raffaela Mirandola, Henry Muccini, Marta Patiño-Martinez,
Marinella Petrocchi, Leila Ribeiro, Francesca Rossi, Aad van Moorsel, Marco Vieira
and several anonymous reviewers.

August 2009

Rogério de Lemos
Jean-Charles Fabre
Cristina Gacek
Fabio Gadducci
Maurice ter Beek

Table of Contents
Part 1. Dependable Service-Oriented Architectures
A System of Architectural Patterns for Scalable, Consistent and Highly
Available Multi-Tier Service-Oriented Infrastructures................. 1
Ricardo Jimenez-Peris, Marta Pati˜no-Martinez, Bettina Kemme,
Francisco Perez-Sorrosal, and Damian Serrano
Towards Self-adaptation for Dependable Service-Oriented Systems.....24
Valeria Cardellini, Emiliano Casalicchio, Vincenzo Grassi,
Francesco Lo Presti, and Raﬀaela Mirandola
Architecting Dependable Access Control Systems for Multi-domain
Computing Environments.........................................49
Maciej P. Machulak, Simon E. Parkin, and Aad van Moorsel
Soft Constraints for Dependable Service-OrientedArchitectures........76
Stefano Bistarelli and Francesco Santini
Robustness Validation in Service-Oriented Architectures..............98
Nuno Laranjeiro, Marco Vieira, and Henrique Madeira
Part 2. Fault Tolerance and System Evaluation
A Self-repair Architecture for Cluster Systems.......................124
Fabienne Boyer, Noel De Palma, Olivier Gruber,
Sylvain Sicard, and Jean-Bernard Stefani
Handling Software Faults with Redundancy.........................148
Antonio Carzaniga, Alessandra Gorla, and Mauro Pezz`e
A Uniform Approach to Security and Fault-Tolerance Speciﬁcation and
Analysis........................................................172
Gabriele Lenzini, Fabio Martinelli, Ilaria Matteucci, and
Stefania Gnesi
A Comprehensive Exploration of Challenges in Architecture-Based
Reliability Estimation............................................202
Ivo Krka, George Edwards, Leslie Cheung, Leana Golubchik, and
Nenad Medvidovic

XII Table of Contents
Part 3. Architecting Security
Weak Behavioral Equivalences for Verifying Secure and Performance-
Aware Component-Based Systems..................................228
Alessandro Aldini and Marco Bernardo
Architecting Security with Paradigm...............................255
Suzana Andova, Luuk P.J. Groenewegen, Jan H.S. Verschuren, and
Erik P. de Vink
Trust-Based and Context-Aware Authentication in a Software
Architecture for Context andProximity-Aware Services...............284
Gabriele Lenzini
Compositional Veriﬁcation of Architectural Refactorings..............308
D´enes Bisztray, Reiko Heckel, and Hartmut Ehrig
Author Index..................................................335

A System of Architectural Patterns for Scalable,
Consistent and Highly Available Multi-Tier
Service-Oriented Infrastructures

Ricardo Jimenez-Peris
1
, Marta Pati˜no-Martinez
1
, Bettina Kemme
2
,
Francisco Perez-Sorrosal
1
, and Damian Serrano
1
1
Universidad Polit´ecnica de Madrid (UPM), Madrid, Spain
{rjimenez,mpatino,fpsorrosal,dserrano }@fi.upm.es
2
McGill University, Montreal, Canada
[email protected]
Abstract.Service-oriented architectures have become prevalent in enterprise
information systems. The underlying infrastructure is typically architected with
multiple tiers in order to separate the different concerns such as interface, business
logic and data. Modern information systems have strict availability and scalability
requirements. The main technique to attain these properties is replication. How-
ever, system architects are confronted with a complex environment in which they
have to decide which tier(s
have great implications for the degree of scalability and availability that can actu-
ally be achieved. Furthermore, maintaining consistency is affected by the way the
system is replicated. In this chapter, we survey the state of the art in this area and
digest it in the form of a system of architectural patterns that will guide system
architects and practitioners in evaluating and selecting the appropriate architec-
tural choices to attain a highly available, consistent and scalable service-oriented
infrastructure.
1 Introduction and Background
Current information systems are often built using multi-tier architectures. In a multi-tier
architecture there is a separation of concerns, in which each tier takes care of a different
aspect. Most commonly, the web interface is dealt with by the web tier, the business
logic is implemented in the application server tier and data is stored in the database tier.
Two important requirements for modern information systems are high availability and
scalability. High availabilityimplies the ability to tolerate node failures and perform
node recovery while at the same time continue to provide service. Scalability means
that a continuously increasing load can be handled by incrementally adding system
resources without increasing the response time of individual requests.

This research has been partially funded by Microsoft Research Cambridge under the PhD
Award programme (grant MS-2006-06), the Spanish National Science Foundation (MICINN)
under grant TIN2007-67353-C02, the Madrid Regional Research Council (CAM) under
the AUTONOMIC project (S-0505/TIC/000285), and the European Commission under the
NEXOF-RA project (FP7-216446).
R. de Lemos et al. (Eds.): Architecting Dependable Systems VI, LNCS 5835, pp. 1–23, 2009.
cSpringer-Verlag Berlin Heidelberg 2009

2 R. Jimenez-Peris et al.
Both scalability and availability requirements can be addressed by replication. Repli-
cation is a technique that consists in introducing redundancy by running a server on mul-
tiple nodes. Thus, it becomes possible to tolerate failures of individual nodes as other
nodes can take over, and allows for splitting the work among the different nodes. Many
replication solutions are either designed for availability or for scalability, but some serve
both purposes. However, replication has the challenging task of replica control to main-
tain consistency. Most high-throughput information systems have strong consistency
requirements that demand that replicas are always consistent (replicated data should
have the same state at all replicas) in order to achieve replication transparency.
Integrating replication into a multi-tier architecture is particularly complex as tiers
interact and affect each other. Consistency in the replicated environment must now not
only be maintained within a tier but across tiers. There exist several architectural choices
with different potential and implications for scalability, availability and consistency. In
this chapter we explore severalarchitectural patterns that describe how replication can
be performed across a multi-tier architecture in order to satisfy the high availability,
consistency and/or scalability requirements. Many existing replication solutions can
be described by a combination of these patterns. Thus, we survey the state of the art
in this area and digest it in the form of a system of architectural patterns that will
guide system architects and practitioners in evaluating and selecting the appropriate
architectural choices in order to replicate multi-tier software infrastructures.
The rest of the chapter is organized as follows. We ﬁrst provide an overview of the
system of architectural patterns for providing availability, scalability and consistency
to multi-tier infrastructures. The followingsections provide descriptions of each of the
proposed architectural patterns. Finally, we present the related work and conclusions.
2 Overview of the System of Architectural Patterns
In this chapter, we focus on stateful tiers, that is, the tiers that maintain some form of
state, as consistency is more difﬁcult to achieve for these tiers. In most systems, both
the application server and the database tiers maintain state. The application server tier
implements the applications business logic. We assume clients connect directly to the
application server tier and then maintain a session during which several requests can
be sent to the application server. The application server thus maintains some session
state that lasts across the boundaries of individual requests. The application server in
turn accesses a database system (also called back-end or data tier) to retrieve and up-
date persistent data. The application server and database together build the server-side
system we consider, while the client is external and usually an independent unit. An
application server might also call another application server or several databases to ex-
ecute a single client request (e.g. [KMSL08]). However, we do not consider these cases
in this chapter.
Figure 1 provides an overview of the architectural patterns that we have identiﬁed.
In this section, we will shortly introduce them. The remaining sections are then dedi-
cated to discuss each of them in detail. The architectural patterns we describe address
different problems at different levels of abstraction. The highest level provides a coarse
categorization of how to replicate. One possibility is to replicate only a single tier. In
this case, there are two options.

Patterns for Scalable, Consistent and HA Multi-Tier Service-Oriented Infrastructures 3
Multi-Tier
System
Replicated
Multi-Tier System
Session
Replication
DB
Replication
Horizontal
Replication
Vertical
Replication
Registry-Based
Replica Discovery
Multicast-Based
Replica Discovery
Replica Discovery
White-Box
DB Replication
Gray-Box
DB Replication
Black-Box
DB Replication
Middleware-Based
DB Replication
uses
uses
Proxy
Transparent
Replication Proxy
uses
usesuses
uses
Multi-Tier
Coordination
uses
Replication
Awareness
Fig. 1.System of Patterns for Availability and Scalability of Multi-Tier Systems
Firstly, in theDB Replicationpattern the database is replicated while there is a single
(non-replicated) application server instance (Fig.2). There exist three main variants for
the DB replication pattern depending on the architectural choice taken to materialize it.
TheWhite-Box DB Replicationpattern is used when replication is integrated into the
database kernel. Alternatively, theMiddleware-Based DB Replicationpattern encapsu-
lates the replication logic in a middleware, decoupling replication from the database
engine, and has two sub-patterns (see Fig. 1). In theBlack-Box DB Replicationpat-
tern, an off-the-shelf database systemcan be used without any additional functionality
for replication, while theGray-Box DB Replicationpattern expects some functionality
from the database in order to facilitate the tasks at the middleware layer.
Secondly, theSession Replicationpattern indicates replication at the application
server tier where several application server instances share a single database instance
(Fig.3). The name of the pattern is derived from the fact that if the application server is
replicated for availability purposes, then the session state of individual clients needs to
be replicated in order to allow for failover in case of individual node failures.
A particular challenge for application server replication is that it is not the last tier.
A request execution at the application server might trigger execution at the database,
which makes more complex failure-handling. TheMulti-Tier Coordinationpattern is
used to track executions that cross tier boundaries and helps the session replication
pattern to maintain consistency across tiers despite failures.
However, replicating a single tier limits the potential for availability and scalabil-
ity. Firstly, the non-replicated tier remains a single point of failure, and therefore high
availability is not provided as a single component failure can interrupt service pro-
vision. Secondly, only the replicated tier can be scaled. Workloads might be purely

4 R. Jimenez-Peris et al.
DB Replica 1 DB Replica 2 DB Replica N li 1
DB
lica 2
DB
li N
DB
...
Client Client Client
Application
Server
Fig. 2.DB Replication
AS Replica 1
Application
Server
Client Client Client
AS Replica 2
Client Client Client
AS Replica N
Client Client Client
...
Application
Server
Application
Server
DB
Fig. 3.Session Replication
compute intensive (putting the main burden on the application server tier), or data in-
tensive (requiring large resources from the database tier), in which case it is enough for
load-balancing purposes to replicate only the tier under stress. However, workloads are
often dynamic and might change focus over time, making the non-replicated tier the
system bottleneck. Furthermore, even if workloads are static, a single-server tier limits
scalability as it hasbounded capacity that can always be exceeded.

Patterns for Scalable, Consistent and HA Multi-Tier Service-Oriented Infrastructures 5
DB Replica 1 DB Replica 2 DB Replica N
AS Replica 1
Application
Server
Client Client Client
AS Replica 2
Client Client Client
AS Replica N
Client Client Client
...
Application
Server
Application
Server
li 1
DB
ica2
DB
liN
DB
...
Fig. 4.Horizontal Replication
So far, there do not exist many solutions that allow for replication of all tiers. An ob-
vious approach would be to simply replicate each tier independently without taking into
account whether the other tier is replicated or not. However, this can easily introduce
inconsistency problems [KJPS05], especially in the advent of failures or other dynamic
changes due to load balancing, self-provisioning, etc. The following two patterns take
the overall architecture into account.
In theHorizontal Replicationpattern (see Fig.4) each tier implements its own repli-
cation solution. Thus, it uses the session replication pattern for the application server
tier and the DB replication pattern for the database tier. Additionally, it makes the tiers
aware of the replication of the other peer. For that purpose it uses theReplication Aware-
nesspattern.
While horizontal replication attempts to glue together individual replication solu-
tions, theVertical Replicationpattern takes a holistic approach to replication (Fig.5).
It pairs one application server instance and one database instance and makes it a unit
of replication. Each node contains one such pair. The replication logic is encapsulated
in the application server. That is, the entire replica control algorithm guaranteeing the
consistency of both the session information of the application server and the database
copies is implemented in the application server tier. Thus, this approach uses theSession
Replicationpattern but performs extra actions at the application server tier to guarantee
the consistency of the database replicas. The database servers themselves do not have
any replication support, not even at an intermediate middleware layer. This pattern has
been successfully used for both to provide high availability [PPJV06] and scalability
[PPJK07, BFG
+
06].

6 R. Jimenez-Peris et al.
Replica 1
Application
Server
Client Client Client
Replica 2
Client Client Client
Replica N
Client Client Client
...
Application
Server
Application
Server
DB DB DB
Fig. 5.Vertical Replication
There are a number of other more basic patterns that are used by some of the afore-
mentioned higher level patterns. The ﬁrst one is theTransparent Replication Proxy
pattern that is a specialization of theProxypattern [BMR
+
96]. TheProxypattern sim-
pliﬁes distributed computation by installing on one node a local representative of an
object, component or service that actually resides on a different node. The local repre-
sentative has the same interface as the remote object and hides the detail of the remote
interaction. TheTransparent Replication Proxypattern enhances theProxypattern with
replication transparency. This pattern relies on theReplica Discoverypattern, that al-
lows a dynamic search for available replicas. TheReplica Discoverypattern has two
sub-patterns; the fully decentralizedMulticast-Based Replica Discoverypattern and the
centralizedRegistry-Based Replica Discoverypattern.
In the next sections, we discuss each of these patterns in more detail. The order we
introduce the individual patterns has been chosen as to avoid forward references as
much as possible.
3 Replica Discovery Pattern
TheReplica Discoverypattern decouples the client from the particular set of nodes
where the replicated service is running. The client uses a discovery service to ﬁnd the
current available replicas. It then typically connects to one of them.
3.1 Problem
The goal is to decouple the code of a replicated service from the actual set of physical
nodes running the replicated service. That is, changes in the actual set of available
replicas should not require changing the code of the replication service or the services
running on top, nor should it require halting the system at any time.
3.2 Solution
A replica discovery service is delegated with the responsibility of ﬁnding the actual set
of available replicas. This can be achieved through different mechanisms. Following

Patterns for Scalable, Consistent and HA Multi-Tier Service-Oriented Infrastructures 7
Fig. 6.Multicast-Based Replica Discovery
Fig. 7.Registry-Based Replica Discovery
theMulticast-Based Replica Discoverypattern, a multicast service is used. Replicas
are subscribed to a channel of a multicast service (e.g. IP multicast). The client sends
a replica discovery message to this channel (see steps 1-2 in the interaction diagram
depicted in Fig. 6) that is multicast to all replicas (possibly unreliably as in the case of
IP multicast). One, some or all the replicas reply to the message (steps 3-4) with the
actual list of available replicas including the necessary data to connect them such as IP
address, port, etc. The client then chooses one of the replicas (step 5) and connects to
it (steps 6-7). The replicas do not need to know each other and the approach is fully
decentralized.
In the alternativeRegistry-Based Replica Discoverypattern clients look up connec-
tion information in well-known registry or registries that are kept updated with the
current list of available replicas (steps 1-2 in Fig. 7 represent the update of the registry;
steps 3-4 represent the acquisition of the list of available replicas; steps 5-6 represent
the connection to the chosen replica).

8 R. Jimenez-Peris et al.
TheMulticast-Based Replica Discoverypattern is ideal for local area networks as
it is completely distributed and can be implemented efﬁciently in such networks. In
contrast, having a centralized registry component is necessary when the former pattern
is not possible, e.g., in wide area networks, or across multiple network segments when
IP multicast is not available.
4 Transparent Replication Proxy Pattern
In multi-tier architectures, clients often interact with servers by means of theProxy
pattern [BMR
+
96]. For instance, we can consider the JDBC driver which is installed at
the client as a proxy of the database server.Similarly, clients receive proxy objects of
the beans of a J(2)EE server which allows them to submit requests to the server as if
they were local requests. TheTransparent Replication Proxypattern is a specialization
of theProxypattern. It can be used when the server is replicated in order to provide
replication transparency. Manyreplication solutions use theTransparent Replication
Proxypattern to let a client transparently interact with a replicated system as if it were
not replicated.
4.1 Problem
An existing application runs on a service infrastructure based on theProxypattern
[BMR
+
96] (such as J(2)EE beans or JDBC drivers). The goal is to make this application
highly available by using a replicated version of the underlying infrastructure. However,
the application that runs on the non-replicated infrastructure must not be changed. In-
stead, the application should run on the replicated infrastructure transparently.
4.2 Solution
TheProxypattern is specialized to provide replication transparency. The proxy, running
at the client side, uses theReplica Discoverypattern to ﬁnd available replicas. Then, it
connects to one of the replicas (steps 1-2 in Fig. 8) according to some criterion such
as random selection, load-based, etc. All requests from the client are forwarded to the
connected replica (step 3). Upon failure of the replica (steps 6-7), the proxy connects
to another of the available replicas (steps 8-9). In order to achieve full replication trans-
parency, the failover should not be visible to the client. For that, if the client had an
outstanding request for which no response was received before the failure, the proxy
must implement adequate mechanisms to obtain an appropriate response from the new
replica. In most cases, this means that the proxy resubmits the outstanding request to
the new replica. A mechanism must be in place that guarantees that despite this re-
submission the request is not executed more than once at the application server and
the database system. How this is exactly handled, depends on the replica control algo-
rithm that is used. We will show later, how thisTransparent Replication Proxypattern
works together with a replica control mechanism to provide exactly-once execution in
the system.

Patterns for Scalable, Consistent and HA Multi-Tier Service-Oriented Infrastructures 9
Fig. 8.Transparent Replication Proxy Scenario I: Returning Checkpointed Reply
Fig. 9.Transparent Replication Proxy Scenario II: Submission Re-Execution

10 R. Jimenez-Peris et al.
In here we abstract the checkpointing mechanism of the response. We consider 2
cases. (1) The request was successfully processed and persisted in which case the re-
sponse needed to be checkpointed to deal consistently with the failover without re-
executing the request (Fig. 8). (2
sisted and needs to be re-executed (Fig. 9).
In case (1) the response is successfully checkpointed (steps 4-5 in Fig. 8). This en-
ables the replica taking over upon resubmission of the client request (step 10) to retrieve
the checkpointed response (steps 11-12) and return it to the client (step 13).
In case (2) the response was not successfully checkpointed (steps 3-4 in Fig. 9).
Upon failover (step 5), the proxy connects to a new replica (steps 6-7) and resubmits
the request (step 8). This time the request is successfully executed and checkpointed
(steps 9-10). The result is returned to the proxy (step 11).
5 DB Replication Pattern
TheDB Replicationpattern allows for the replication of the database tier aiming at
both availability and scalability. The pattern relies on theTransparent Replication Proxy
pattern applied to the database connectivity component (e.g. JDBC or ODBC driver) to
provide replication transparency.
5.1 Problem
The goal is to keep data highly available and consistent enabling their processing in a
scalable way.
5.2 Solution
In database replication, not only the server functionality is replicated but also each
database server has typically a full copy of the database. Thus data consistency among
the database copies plays a major role and some replica control mechanism is re-
quired. There exist many different replica control algorithms (examples can be found in
[PJKA05, LKPJ05, ACZ03, PGS03, KA00]), but basically all algorithms use a special
form of ROWA (read-once, write-all) approach (see Fig. 10): (1
tion can be executed at any replica locally without any further coordination with other
replicas. (2) An update transaction is executed at one replica, and its updates are propa-
gated and executed at the other replicas either sometime during the transaction or after
its commit. As transactions run concurrently at the different replicas accessing the dif-
ferent copies of data items, replica control needs to be coupled with a concurrency
control algorithm in order to provide the desired level of isolation.
Thus, the basic steps of theDB Replicationpattern can be summarized as below.
Note that while different replica control protocols might differ in the order and the
details of the steps, the described actions can be found in most algorithms.
Given a transaction, all its operations are submitted to one of the replicas (step 7 for
read-only transactions and step 13 for update transactions in Fig. 10). Different trans-
actions can be submitted to different replicas. When a database replica receives an op-
eration request (steps 7, 13), it executes it (steps 9, 15) locally and returns the response

Patterns for Scalable, Consistent and HA Multi-Tier Service-Oriented Infrastructures 11
Fig. 10.DB Replication: Failure Free Scenario
(steps 11, 21). At the end of transaction, if the transaction is read-only, it is committed
locally (step 10). If the transaction has updated the database, it retrieves the updated tu-
ples (step 16) (and depending on the replica control protocol, also the identiﬁers of the
objects read) and propagates it to all replicas (steps 17-18). A global serialization order
must be determined among concurrent conﬂicting transactions. This can be achieved by
generating a total order among all update transactions and then only allow transactions
to commit, if they can be serialized according to this total order. The mechanisms how
this can be achieved can vary from setting distributed locks to optimistic protocols that
use a total order multicast and perform certiﬁcation of transactions (the latter exem-
pliﬁed in steps 19-20). For a taxonomy of database replication protocols the reader is
referred to [KJPA09].
Sub-Patterns.We distinguish several sub-patterns of theDB Replicationpattern. The
White-Box DB Replicationpattern [KA00, PF00] integrates replication into the database
kernel. While it can exploit the existing concurrency control mechanism of the database
system, and thus, can be strongly optimized, the strong coupling of database engine and

12 R. Jimenez-Peris et al.
replication logic leads to increased complexity and maintenance costs. Additionally, it
is necessarily vendor speciﬁc. An alternative is theMiddleware-Based DB Replica-
tionpattern. This pattern encapsulates the replication logic in a replication middleware
which lies between client and database. This approach was ﬁrst proposed in Middle-
R [JPKA02, PJKA05] and become very popular [ACZ03, CMZ04]. While it provides
a more ﬂexible approach, it has a further level of indirection. Furthermore, concur-
rency control is now often implemented both in the replication layer and in the database
kernel, leading to its own complexity. While there exist several approaches with only
one middleware component [ACZ03], availability can only be achieved if the middle-
ware is replicated, too. The most common approach for this is to have one middle-
ware replica in front of each database replica, treating both as one unit of replication
[JPKA02, PJKA05]. There are two variants of theMiddleware-Based DB Replication
pattern. TheBlack-Box DB Replicationpattern uses a standard database server with-
out any replication functionality [AT02]. A challenge with this pattern is to capture the
update operations and to apply them efﬁciently at the remote replicas. An alternative
that combines the good performance of theWhite-Box DB Replicationpattern and the
advantages of a middleware-based approach is theGray-Box DB Replicationpattern
[JPKA02, PJKA05]. In this pattern, the database exposes some functionality, e.g., the
provision of updated records, which can be exploited by the replication middleware to
more efﬁciently implement its tasks. A specialization of this pattern is theReﬂective DB
Replicationpattern in which by means of reﬂection the different stages of transactional
processing can be intercepted to add a replica control protocol. This pattern has been
exercised in the Gorda project [JPR
+
09].
Scalability.As shown in [PJKA05], ROWA approaches are the best solution if scal-
ability is required as typical workloads have a much higher read than write load, and
ROWA distributes reads over all replicas while only writes need to be executed at all
replicas. Additionally, theWhite-BoxandGray-Box DB Replicationpatterns also al-
low for an efﬁcient execution of write operations if updates are propagated by simply
indicating the physical after-images of updated records and by providing specialized
methods to apply these changes on remote replicas. Then, only the local replica has to
execute the complete write operation while the other replicas perform more efﬁcient
apply operations, freeing up additional processing capacity.
Replication Transparency.In order to hide replication from the clients, theDB Replica-
tionpattern can use theTransparent Replication ProxyandReplica Discoverypatterns
for the interaction between clients and database replicas. The database connectivity
component (e.g., the JDBC driver) implements theTransparent Replication Proxypat-
tern. A client interacts with the database through this enhanced database connectivity
component. This proxy discovers through theReplica Discoverypattern the database
replicas (or middleware replicas) and connects to one of them which is then the one it
will execute the transaction locally.
TheDB Replicationpattern together with theTransparent Replication Proxypat-
tern also handles failures and guarantees exactly-once execution. Upon a failure of the
replica processing the transaction for a client, the proxy detects it and performs failover
to another replica. We want to outline solutions for two cases. First, when each operation

Patterns for Scalable, Consistent and HA Multi-Tier Service-Oriented Infrastructures 13
is a single transaction, and then, when a transaction can consist of several operations.
In both cases, we assume that replica control propagates all updates a transaction has
performed to remote replicas in a single message at the end of transaction just before
the transaction is committed locally.
For single-operation transactions we can distinguish several cases. (1) The failure
occurred when the client had no outstanding request. Then, nothing special has to be
done. The proxy simply sends the next request to the new replica. (2
occurred when there was an outstanding request the proxy resubmits the request to the
new replica. The new replica might have received the updates before the failure or not.
If it has, it should simply return the outcome of the transaction (it either committed
or aborted due to conﬂicts). If it has not received the updates, it will simply execute
the transaction as a new transaction. In allcases, each request leads to one transaction
executed in the system.
For multi-operation transactions there exist several solutions and we only outline
one. The proxy keeps track of all operations of the current transaction and the responses
it receives. It can discard them when a transaction terminates. In case of a failure, we can
distinguish the following cases. (1) The failure occurred when no transaction was active,
i.e., the last response the client received was a commit conﬁrmation. Then, the proxy
simply submits the operations of the next transaction to the new replica. (2
occurred while a transaction was active, i.e., the client has an outstanding read or update
request. In this case, the proxy can resubmit all requests to the new replica, replaying
transaction execution. If it receives the same responses as in the original execution,
execution can resume where it stopped before the crash. If not, the transaction must
be aborted. (3) The failure occurred when the client had submitted a commit request
but before the failed replica responded. In this case, the proxy resubmits the commit
request to the new replica. The new replica might have received or not received the
updates from the failed replica before the failure. In the ﬁrst case it can simply return
the outcome of the transaction (which was either committed or aborted) to the proxy.
In the second case it should return an abort as it does not know about this transaction.
Then, the proxy will continue as under (2).
6 Multi-Tier Coordination Pattern
TheMulti-Tier Coordinationpattern is useful to track executions that cross tier bound-
aries in a multi-tier architecture.
6.1 Problem
In multi-tier architectures, many client requests lead to execution and state changes at
both the application server and database server. If the application server tier is now
replicated for availability purposes any failover procedure has to consider the state of
the database at the time of the application server failure. When an application server
fails before returning the response to a speciﬁc request, the database transaction might
already be terminated, or it might be still active. In the latter case, the database typically
aborts the transaction when the connection to the application server breaks. When using

14 R. Jimenez-Peris et al.
failover, the application server tier needs to know the state of the database transactions.
However, standard database interfaces do not provide information about the state of
transactions that have already terminated.
6.2 Solution
TheMulti-Tier Coordinationpattern is used to keep track of transaction state at the ap-
plication server. One possible implementation is to use a so-called marker mechanism
[FG02]. Whenever it becomes crucial for theapplication server tier to know whether
an update transaction will commit or not, it inserts the client request identiﬁer that trig-
gered this transaction into the database. This identiﬁer is called a marker. This insert is
just another write operation of the transaction. Once the database transaction commits,
the marker is a readable record in the database. If the database transaction aborts, no
marker will be found as the transaction rolls back all write operations it has performed.
At the time of failover, if it is necessary to probe the outcome of a certain transaction,
the application server tier can simply check whether the record with the corresponding
request identiﬁer exists in the database. If it does, the transaction committed. If the
marker cannot be found, the transaction aborted. Thus, theMulti-Tier Coordination
pattern allows the application server tier to determine the state of the database.
7 Session Replication Pattern
TheSession Replicationpattern is commonly used to achieve availability and scalability
in the application server tier. An important challenge for the application server tier is
that request execution does not only change the state at the application server but might
also access the database. Any availability and failover solution has to be aware of this
distributed execution. Thus, theSession Replicationpattern also relies on theMulti-
tier Coordinationpattern. For client interaction, the pattern relies on theTransparent
Replication Proxypattern.
7.1 Problem
An application is deployed over a multi-tier architecture. The application requires avail-
ability at all times and thus must be able to tolerate failures of individual components
without halting execution. The application is computational intensive and also requires
scalability, that is, the underlying infrastructure should be able to grow to deal with
continuously increasing loads.
7.2 Solution
TheSession Replicationpattern replicates the application server tier over a cluster of
nodes. Each node contains an instance of the application server plus the session repli-
cation logic. The application server replicas share a single database instance. Similar
to database replication, a client connects to one replica. Different servers might serve
different clients leading to load-distribution, and thus, potential for scalability. The ap-
plication server maintains some session state for the duration of the client connection.

Patterns for Scalable, Consistent and HA Multi-Tier Service-Oriented Infrastructures 15
Fig. 11.Session Replication: Failover and Restore of Previously Saved Result
For fault-tolerance purposes, the sessionstate of each client should be replicated on
several servers. Session replication requires replica control to keep the session copies
on the different servers consistent. That is, when client requests lead to a change of the
session state the local replica of the client has to propagate the changes to the remote
replicas. Different to database replication,concurrency control is not an issue as differ-
ent clients have disjoint session state. When the local server replica of a client fails, the
client will be transferred to another server with a copy of its session state.
Replication Transparency.TheSession Replicationpattern uses theTransparent Repli-
cation Proxypattern (and therefore theReplica Discoverypattern as well) for the in-
teraction between clients and application server replicas. A client discovers through the
Replica Discoverypattern one of the application server replicas and connects to it (steps
1-2 in Fig. 11). It will be its local replica and will execute all requests. It will also make
the necessary calls to the database system. In our description, we assume that each client
request corresponds to a single database transaction. Extensions are possible to more
complex transaction interaction patterns like the ones provided by [WK05, KJPS05].
Replication transparency requires that each request is executed exactly once in the
system despite replication and possible failures. The tasks to achieve this are split

16 R. Jimenez-Peris et al.
Fig. 12.Session Replication: Failover and Re-Execution
between theSession Replicationpattern and theTransparent Replication Proxypattern
with the use of theMulti-Tier Coordinationpattern. We describe here one possible
implementation.
When the local application server of a client receives a request (step 3 in Fig. 11),
it executes it locally (step 4), potentially interacting with the shared database instance
(steps 5-6). Just before ﬁnishing executing (and committing the database transaction if
one was started), the session state plus the response to be sent to the client are propa-
gated to the server replicas that replicate that particular session. Furthermore, if an up-
date transaction is associated with the request execution, theMulti-Tier Coordination
pattern is applied in order to be able to keep track of the outcome of this transaction (the
marker is written in steps 7-8). Only when the remote replicas conﬁrm the reception of
these state changes is the database transaction committed and the response returned to
the client. The remote replicas keep track of the last two state changes it receives for
each session. Note that the tasks of the remote replica on behalf of this session are not
compute intensive. Thus, its main processing power can be used to serve its own clients.

Patterns for Scalable, Consistent and HA Multi-Tier Service-Oriented Infrastructures 17
When a replica now fails (step 11) the client proxy will ﬁnd and connect to a new
replica that has a copy of the session state through theReplica Discoverypattern (steps
12-13 show the connection to a backup replica, the discovery is not shown). If there
was an outstanding request, the proxy will resubmit the request to the new replica. Sev-
eral cases can be distinguished. (1) The newreplica had not received the state changes
on the session and the response associated with this request before the failure. In this
case, it is impossible that the database transaction had committed, and the new replica
can safely execute the request as a new request. (2) The new replica has received the
state changes (see Fig. 11). It will use theMulti-Tier Coordinationpattern in order to
determine whether the corresponding database transaction committed (by checking if
a marker exists in the database, steps 15-16 in Fig. 11). If yes, it will install the state
changes locally (step 17) and immediately return the response (step 18). Execution has
completed at both the application server and database. If the database transaction had
not committed (see Fig. 12. The failure in step 9 happens before transaction commit-
ment.), the marker will not be found (steps 13-14) and it will be unable install the state
changes. It will therefore resort to the previous state of the session. Thus, no changes
on behalf of this request remain in the system. The new replica will execute the request
(step 15) and do the rest of the processing as if it were a new request (steps 16-22). This
guarantees exactly-once semantic across the application and database tiers.
8 Horizontal Replication Pattern with Replication Awareness
Pattern
TheHorizontal Replicationpattern provides high availability and scalability for appli-
cations deployed on multi-tier architectures. It consists in replicating each tier indepen-
dently and then introducing replication awareness as needed. What kind of replication
awareness is needed depends on the replication algorithms in the different peers.
8.1 Problem
A service is deployed over a multi-tier architecture; the goal is to enhance it with high
availability and scalability.
8.2 Solution
The main conceptual difference to the approaches that only replicate one tier is that the
clients of the database tier, namely the sessions in the application server tier, are now
replicated. In the non-failure case, each sessionon any of the application server replicas
will connect to one of the database replicaswhich will become the local replica of the
session.
Failures have now to be considered more carefully. To this end, we should consider
the following cases. (1) An application server replica could fail, and another applica-
tion server replica takes over the failed sessions. (2) A database replica fails and its
connected sessions are failed over to a new database replica. (3
server replica and its local database fail.

18 R. Jimenez-Peris et al.
Replication Transparency.TheReplication Awarenesspattern is used to guarantee that
the failover procedures at one tier consider the particular situation of the other tier. In
this chapter, we only give one example for the need of replication awareness and a pos-
sible solution. Assume an application server replica fails and another replica takes over
the sessions of the failed replica. Withoutany additional mechanisms, the new replica
might connect to any database replica using theReplica Discoverypattern. It might not
be the database replica the failed application server replica was connected to. At the
beginning of the failover, the new application server replica will apply theMulti-Tier
Coordinationpattern to determine the state of outstanding transactions. As this pattern
is not designed for replicated databases, its implementation might return the wrong re-
sult. For instance, it might look for a marker in the new database replica ignoring the
fact that this is not the same database replica the marker was originally inserted. The
DB Replicationpattern will eventually assure thatall database replicas have the same
state. However, asynchrony conditions might lead to a situation where the new appli-
cation server primary checks for the marker and only then update propagation occurs
and the marker is inserted at the remote database replicas. Thus the application server
tier wrongly assumes that the transaction did not commit while it actually committed.
The application server tier might re-execute the transaction, leading to a violation of
exactly-once semantics.
Replication awareness has to guarantee that the protocols are synchronized. Check-
ing for the commit of a database transaction should occur at a database replica only
after this replica has terminated (committed or aborted) the transaction to make sure
the correct result is returned. As replicas of both tiers can fail at the same time, this is
not trivial to achieve. A possible implementation can make the database client proxy
and the replica control protocol aware of the fact that the client is replicated. Assume a
concrete implementation with the client proxy being the JDBC driver and a middleware-
based replication approach. TheReplication Awarenesspattern can be implemented in
the client proxy and the replica control algorithm of the middleware. Furthermore, the
client proxy becomes part of the session and the session replication logic has to propa-
gate its state together with the session state. Then, at failover time, the JDBC proxy can
connect to the same database replica the JDBC proxy on the failed application server
replica was connected to. It can furthermore coordinate with the replica control mecha-
nism of the database to guarantee that both are synchronized before the failover activity
at the application server starts. Details of this could be done can be found in [KJPS05].
Scalability.Using theHorizontal Replicationpattern, one can decide dynamically and
individually on the number of replicas in each tier. For availability purposes it is likely
enough to replicate session state on 2 to 3 other replicas. For scalability, one can add as
many application server replicas as needed. At the database side, replicas can also be
added on demand.
9 Vertical Replication Architectural Pattern
TheVertical Replicationpattern [PPJK07] also aims at providing high availability and
scalability for applications deployed on multi-tier architectures. It takes a pair of ap-
plication and database servers as a replication unit. Each pair is allocated to a different

Patterns for Scalable, Consistent and HA Multi-Tier Service-Oriented Infrastructures 19
node. The replication logic is encapsulated on the application server. The database is
considered a black box without any awareness for replication. The pattern relies on the
Session Replicationpattern for providing session availability and associated patterns.
9.1 Problem
A service is deployed over a multi-tier architecture; the goal is to enhance it with high
availability and scalability.
9.2 Solution
In this pattern a pair of application and database servers is used as the replication unit.
Each of such pairs is allocated to one of the nodes that run the replicated system. The
database is not aware of replication or distribution. The application server encapsulates
the replication logic and takes care of guaranteeing the consistency of both the appli-
cation server and database tiers. For the application server state similar mechanism as
described for theSession Replicationpattern can be used. However, replica control has
to be extended to also cover the replicated database state. The tasks associated with this
can be handled similarly to what we described for theDB Replicationpattern.
A possible implementation can be outlined as follows (see Fig. 13 for a failure free
scenario). The client connects to one of the application server replicas (steps 1-2). The
replica will be the local replica for the client and receives the client request (step 3).
The request is executed locally (steps 4-5). When the associated transaction is about to
commit all database records updated by the request and the changed session state are
propagated to all replicas (step 6). Depending on the concurrency control algorithm it
is possible that also the identiﬁers of the read data records need to be propagated. All
update messages need to be globally ordered, e.g., by using a total order multicast. With
this, all replicas will deliver these messages in the same order. Every replica acknowl-
edges the reception of the update to all other replicas (e.g. using a uniform multicast).
Each replica then executes the certiﬁcation protocol (steps 7-8) to decide about the out-
come of each transaction according to the global order. If the transaction under certiﬁ-
cation conﬂicts with any other concurrent transaction (it has updated a tuple updated by
another transaction) that has already committed, then the transaction is aborted. Oth-
erwise, the session state is applied and the database changes are applied before the
transaction is committed (steps 9-12). At the local replica, once the other replicas have
acknowledged the reception of the message, aresponse is sent to the client (step 13).
Replication transparency.This is handled similar to what is described for theSession
Replicationpattern. A failure happens whenever the application or database servers
fail. Upon failure, client proxies resubmit outstanding requests to the new replica they
connect to. Different to theSession Replicationpattern, no multi-tier coordination is
needed. The application server replica has full control and knowledge about what is
happening at its local database replica. Either it has received an update message and
decided on the outcome of the transaction or it has not received it and the transaction
has to be considered aborted.

20 R. Jimenez-Peris et al.
Fig. 13.Vertical Replication: Failure Free Scenario
Scalability.In this replication architecture, the number of application server replicas
and database replicas is always the same as always one replica of each type builds a
replication unit. At ﬁrst view this does not seem to handle well unbalanced workloads
that are either compute or data-intensive.However, as the replicas are installed on one
machine, such an approach provides natural adaptation. If the workload is compute
intensive, the application server will take most of the resources of the node, while if
the workload turns data intensive, the database will claim the resources. Automatic
adaptation takes place.
Thus, given the fact that there is only one replica control algorithm for the entire sys-
tem, allowing for a simpliﬁed coordination, makes this approach look very appealing.
10 Related Work
In the last few years, there has been some work on high availability and scalability
patterns in the pattern community. In [SJ06] a pattern language for high availability is
described. The patterns are divided into two groups. The ﬁrst one describes patterns
for fault tolerance, such as introducing redundancy, the well-known primary-backup
(including conﬂict resolution) andactive replication schemes, and ﬁnallyN+1redun-
dancy (N nodes active plus 1 node acting as a backup for the rest of the nodes). That is,
the focus is on process replication techniques to attain high availability on individual
servers. The second group of patterns describes more basic patterns for fault manage-
ment techniques such as introducing system monitors, send ACKs for every operation
and other mechanisms such as polling. The main differences with the work presented
in this chapter are that the pattern languagedoes not address multi-tier systems, it does
not address data replication, neither addresses scalability.

Patterns for Scalable, Consistent and HA Multi-Tier Service-Oriented Infrastructures 21
The same author describes in [Sin07] a pattern language for scalability, although the
focus is more on improving performance rather than scaling out. Some of the patterns
proposed include algorithm optimization, add hardware, and introduce parallelism. The
patterns are at a more basic level and do not address higher level problems such as the
scalability of data replication and multi-tier systems.
In [Sar02] the author describes also a set of fault tolerant techniques in the form of
a system of patterns for fault tolerance. It focuses on solutions to detect, recover and
masking errors and their combination in order to provide complete solutions to design
fault tolerant software systems. An initial classiﬁcation of the patterns has been made
according to the most relevant aspects of fault tolerance:(1 Are You
Alive?,I Am Alive,ACKs,Fail-Stop Processors), (2 Roll-Back,Roll-
Forward) and (3 Passive,Semi-Passive,ActiveandSemi-Active Repli-
cation). The system of patterns shows the relationships among the different patterns
described as we do in this chapter. For example, the patterns in the latter two categories
rely on error detection mechanisms and this fact is shown in the system of patterns us-
ing a dependency relationship. The classiﬁcation can be extended using new aspects of
fault tolerance, for example error assessment. In this category, the patterns related to
the assessment of the nature of errors can be added (e.g.Leaky Bucket Counter,Riding
Over Transients). In addition to this classiﬁcation, the paper offers another ﬁve clas-
siﬁcation schemes based on other parameters such as complexity, space overhead (in
terms of additional entities), time overheadintroduced in the absence of errors, time
overhead introduced in the presence of errors and failure types where the pattern is
applicable. Finally, the paper shows how the patterns can be combined in design frame-
works for fault tolerant systems and how to evolve the system of patterns. The main
differences with respect the patterns in this chapter is that most of these patterns are
lower abstraction patterns that solve very particular problems in the area of fault toler-
ance. Those more abstract are related to process replication (e.g. active replication).
None of the patterns address data replication, replication of multi-tier systems, nor
scalability.
The authors of [GR97] provide a pattern to support the representation and manage-
ment of replicated objects and the implementation of several replication policies sup-
porting different replica consistency criteria. However, they do not describe how the
failures of the replicated objects can be masked and/or solved with regard to the client
invoking their operations. Scalability is not addressed.
A variation of theProxypattern for distributed environments can be found in
[RAG97]. In this paper, the authors describe aDistributed Proxypattern that is able
to decouple the communication among objects in a distributed environment. As we do
in theTransparent Replication Proxypattern described in this chapter, they achieve
the transparency of the location of the distributed objects by isolating the distribution
speciﬁc issues from object functionality. However, in addition to the location trans-
parency, our pattern provides transparent failover, a key feature to achieve replication
transparency.
Finally, just to point out that many of the patterns for fault tolerance have been also
collected in these two books [ACG
+
96, Han07]. Neither of the books addresses data
replication, replication of multi-tier systems and scalability.

22 R. Jimenez-Peris et al.
11 Conclusions
In this chapter, we have surveyed the main architectural choices to provide availability
and scalability for services and applications deployed multi-tier infrastructures. These
architectural choices have been presented in the form of architectural patterns organized
into a system of patterns. The relation among the different patterns has been identiﬁed
to help system architects to better understand them and how to use them. The knowl-
edge developed during the last two decades on this topic is captured by the system of
architectural patterns that has been presented here, enabling practitioners to acquire this
knowledge through their application.
References
[ACG
+
96] Adams, M., Coplien, J., Gamoke, R., Hanmer, R., Keeve, F., Nicodemus, K.: Fault-
tolerant Telecommunication System Patterns. In: Pattern Languages of Program
Design 2. Addison Wesley, Reading (1996)
[ACZ03] Amza, C., Cox, A.L., Zwaenepoel, W.: Distributed Versioning: Consistent Repli-
cation for Scaling Back End Databases of Dynamic Content Web Sites.. In: Proc.
of the ACM/IFIP/USENIX Int. Middleware Conf., pp. 282–304 (2003)
[AT02] Amir, Y., Tutu, C.: From Total Order to Database Replication. In: Proc. of the IEEE
Int. Conf. on Distributed Computing Systems ICDCS (2002)
[BFG
+
06] Bernstein, P.A., Fekete, A., Guo, H., Ramakrishnan, R., Tamma, P.: Relaxed-
Currency Serializability for Middle-Tier Caching and Replication. In: Proc. of the
ACM Int. Conf. on Management of Data (SIGMOD), pp. 599–610 (2006)
[BMR
+
96] Buschmann, F., Meunier, R., Rohnert, H., Sommerlad, P., Stal, M.: Pattern-
Oriented Software Architecture. A System of Patterns, vol. 1. John Wiley & Sons
Inc., Chichester (1996)
[CMZ04] Cecchet, E., Marguerite, J., Zwaenepoel, W.: C-JDBC: Flexible Database Clus-
tering Middleware. In: Proc. of the ACM/IFIP/USENIX Int. Middleware Conf.,
pp. 9–18 (2004)
[FG02] Frolund, S., Guerraoui, R.: e-Transactions: End-to-End Reliability for Three-Tier
Architectures. IEEE Trans. on Software Engineering 28(4), 378–395 (2002)
[GR97] Gonc¸alves, T., Rito Silva, A.: Passive Replicator: A Design Pattern for Object
Replication. In: Proc. of the European Conf. on Pattern Languages of Programs,
EuroPLoP (1997)
[Han07] Hanmer, R.: Patterns for Fault Tolerant Software. John Wiley & Sons Inc.,
Chichester (2007)
[JPKA02] Jim´enez-Peris, R., Pati˜no-Mart´ınez, M., Kemme, B., Alonso, G.: Improving the
Scalability of Fault-Tolerant Database Clusters.. In: Proc. of the IEEE Int. Conf. on
Distributed Computing Systems (ICDCS), pp. 477–484 (2002)
[JPR
+
09] Correia Jr., A., Pereira, J., Rodrigues, L., Carvalho, N., Oliveira, R.: Practical
Database Replication. In: Charron-Bost, B., Pedone, F., Schiper, A. (eds.) Repli-
cation: Theory and Practice, ch.13. Springer, Heidelberg (2009)
[KA00] Kemme, B., Alonso, G.: Don’t Be Lazy, Be Consistent: Postgres-R, A New Way
to Implement Database Replication. In: Proc. of the Int. Conf. on Very Large Data
Bases (VLDB), pp. 134–143 (2000)
[KJPA09] Kemme, B., Jimenez-Peris, R., Pati˜no-Mart´ınez, M., Alonso, G.: Database Repli-
cation: A Tutorial. In: Charron-Bost, B., Pedone, F., Schiper, A. (eds.) Replication:
Theory and Practice, ch. 12. Springer, Heidelberg (2009)

Patterns for Scalable, Consistent and HA Multi-Tier Service-Oriented Infrastructures 23
[KJPS05] Kemme, B., Jim´enez-Peris, R., Pati˜no-Mart´ınez, M., Salas, J.: Exactly Once Inter-
action in a Multi-Tier Architecture. In: VLDB Workshop on Design, Implementa-
tion, and Deployment of Database Replication (2005)
[KMSL08] Kistijantoro, A.I., Morgan, G., Shrivastava, S.K., Little, M.C.: Enhancing an Ap-
plication Server to Support Available Components. IEEE Trans. on Software Engi-
neering 34(4), 531–545 (2008)
[LKPJ05] Lin, Y., Kemme, B., Pati˜no-Mart´ınez, M., Jim´enez-Peris, R.: Middleware based
Data Replication providing Snapshot Isolation.. In: Proc. of the ACM Int. Conf. on
Management of Data (SIGMOD), pp. 419–430 (2005)
[PF00] Pedone, F., Frolund, S.: Pronto: A Fast Failover Protocol for Off-the-shelf Com-
mercial Databases. In: Proc. of the IEEE Symp. on Reliable Distributed Systems
(SRDS), Nuremberg, Germany, October 2000, pp. 176–185 (2000)
[PGS03] Pedone, F., Guerraoui, R., Schiper, A.: The Database State Machine Approach..
Distributed and Parallel Databases 14(1) (2003)
[PJKA05] Pati˜no-Mart´ınez, M., Jim´enez-Peris, R., Kemme, B., Alonso, G.: MIDDLE-R:
Consistent Database Replication at the Middleware Level. ACM Trans. on Com-
puter Systems 23(4), 375–423 (2005)
[PPJK07] Perez-Sorrosal, F., Pati˜no-Mart´ınez, M., Jim´enez-Peris, R., Kemme, B.: Consistent
and Scalable Cache Replication for Multi-Tier J2EE Applications. In: Proc. of the
ACM/IFIP/USENIX Int. Middleware Conf. (2007)
[PPJV06] Perez-Sorrosal, F., Pati˜no-Mart´ınez, M., Jim´enez-Peris, R., Vuckovic, J.: Highly
Available Long Running Transactions and Activities forJ2EE Applications. In:
Proc. of the IEEE Int. Conf. on Distributed Computing Systems, ICDCS (2006)
[RAG97] Rito Silva, A., Assis Rosa, F., Gonc¸alves, T.: Distributed Proxy: A Design Pat-
tern for Distributed Object Communication. In: Proc. of the Int. Conf. on Pattern
Languages of Programs, PLoP (1997)
[Sar02] Saridakis, T.: A System of Reliability Patterns. In: Proc. of the European Conf. on
Pattern Languages of Programs, EuroPLoP (2002)
[Sin07] Singh Ahluwalia, K.: Scalability Design Patterns. In: Proc. of the Int. Conf. on
Pattern Languages of Programs, PLoP (2007)
[SJ06] Singh Ahluwalia, K., Jain, A.: High Availability Design Patterns. In: Proc. of the
Int. Conf. on Pattern Languages of Programs, PLoP (2006)
[WK05] Wu, H., Kemme, B.: Fault-Tolerance for Stateful Application Servers in the Pres-
ence of Advanced Transactions Patterns. In: Proc. of the IEEE Symp. on Reliable
Distributed Systems (SRDS), pp. 95–108 (2005)

Towards Self-adaptation for Dependable
Service-Oriented Systems
Valeria Cardellini
1
, Emiliano Casalicchio
1
, Vincenzo Grassi
1
,
Francesco Lo Presti
1
, and Raﬀaela Mirandola
2
1
Universit`a di Roma “Tor Vergata”, Viale del Politecnico 1, 00133 Roma, Italy
{cardellini,casalicchio}@ing.uniroma2.it,
{vgrassi,lopresti}@info.uniroma2.it
2
Politecnico di Milano, Piazza Leonardo Da Vinci 32, 20133 Milano, Italy
[email protected]
Abstract.Increasingly complex information systems operating in dy-
namic environments ask for management policies able to deal intelli-
gently and autonomously with problems and tasks. An attempt to deal
with these aspects can be found in the Service-Oriented Architecture
(SOA) paradigm that foresees the creation of business applications from
independently developed services, where services and applications build
up complex dependencies. Therefore the dependability of SOA systems
strongly depends on their ability to self-manage and adapt themselves to
cope with changes in the operating conditions and to meet the required
dependability with a minimum of resources. In this paper we propose a
model-based approach to the realization of self-adaptable SOA systems,
aimed at the fulﬁllment of dependability requirements. Speciﬁcally, we
provide a methodology driving the system adaptation and we discuss the
architectural issues related to its implementation. To bring this approach
to fruition, we developed a prototype tool and we show the results that
canbeachievedwithasimpleexample.
1 Introduction
The SOA paradigm emphasizes the construction of software systems through the
dynamic composition of network-accessible services oﬀered by loosely coupled in-
dependent providers. As a consequence,such systems have to tackle problems
caused by component services becoming unreachable because of connection prob-
lems, or changing their delivered Quality of Service (QoS), or even being turned
oﬀ. These problems have a direct impact on the system dependability, both in
terms of itsavailability(ability to accept a service request, when a service oﬀered
by the system is invoked) and of itsreliability(ability to successfully complete
the requested service, once a requesthas been accepted) [1]. Thus, guarantee-
ing a high dependability level for SOA systems is a key factor for their success
in the envisioned ”service market”, where service providers compete by oﬀering
services with diﬀerent quality and cost attributes [2,3].
R. de Lemos et al. (Eds.): Architecting Dependable Systems VI, LNCS 5835, pp. 24–48, 2009.
cﬀSpringer-Verlag Berlin Heidelberg 2009

Towards Self-adaptation for Dependable Service-Oriented Systems 25
Achieving this goal is a challenging task, as the system must face the high
variability of the execution environment, the dependability requirements of dif-
ferent classes of users, and the limits on the available resources, needed to keep
the system cost within a given budget.
A promising way to cope with these problems is to make the system able to
self-adapt to changes in its environment (available resources, type and amount of
user demand), by autonomously modifying at runtime its behavior or structure.
In this way, the system can timely react to (or even anticipate) environment
changes, trying to use at best the available resources, thus avoiding long service
disruptions due to oﬀ-line repairs [4,5].
Some general proposals about how to architect a self-adaptable software
system have already appeared [6,7,8,9]. These proposals suggest architectural
frameworks which can be used to support the implementation of suitable adap-
tation methodologies, possibly tailored to speciﬁc application domains.
In this respect, methodologies that can be implemented within these archi-
tectural frameworks to drive the adaptation of a SOA system have been already
presented. Some of them speciﬁcally focus on the fulﬁllment of dependability
requirements (e.g., [10]), while others consider multiple quality attributes includ-
ing dependability (see, for example, [11]). Most of these methodologies consider
exclusively a single kind of adaptation mechanism, based onservice selection.
According to this mechanism, the set of component services used to build a
composite SOA system is dynamically selected and bound to the system, based
on the current operating environment conditions and system requirements. The
methodology presented in [10] considers instead a diﬀerent kind of adaptation
mechanism, based onarchitecture selection. In this case, it is the (redundancy
based) architecture for the service composition which isdynamically selected, to
maintain the system ability to meet a dependability requirement.
The scenario these methodologies focus on generally consists of a single re-
quest addressed to a composite SOA system, considered independently of other
requests which could be addressed to the same system. The aim is to deter-
mine the adaptation action which is (possibly) optimal for that single request,
considering a given set of quality requirements and the current conditions of
the operating environment. A limit ofthese methodologies is that they con-
sider a single type of adaptation mechanism (either service selection or architec-
ture selection) when they try to determine the best possible adaptation action.
Instead, considering simultaneously a broader range of adaptation mechanisms
could increase the system ﬂexibility in adapting to diﬀerent environments and
requirements.
Moreover, we point out that methodologies aimed at determining adaptation
actions for single service requests, independently of other concurrent requests,
could incur in problems under a sustained traﬃc of requests addressed to a
composite SOA system. Indeed, the “local” adaptation action they determine
could conﬂict with adaptation actions determined for other concurrent requests,
leading to instability and management problems.

26 V. Cardellini et al.
Another potential limitation of these methodologies is that they generally
formulate the problem to be solved as a NP-hard problem, which could thus
result too complex for runtime decisions. This aspect is particularly critical in a
SOA environment, where adaptation actions are likely to be calculated relatively
often, due to its highly dynamic nature.
Based on these considerations, the main goal of our proposal is to provide ideas
towards the realization of an adaptable SOA system that can ﬂexibly base its
adaptation actions on both kinds of adaptation mechanisms outlined above, to
meet its dependability objectives. Besides providing a suitable modeling method-
ology for this purpose, we also suggest a possible architectural framework for its
implementation. This architecture can be seen as an instantiation for the SOA
domain of the general architectural frameworks outlined above, with a focus on
the fulﬁllment of dependability requirements.
Moreover, diﬀerently from other approaches, we assume an operating scenario
where a quite sustained traﬃc of requests is addressed to a SOA system. Hence,
rather than trying to determine adaptation actions for each single request, our
approach is aimed at determining adaptation actions forﬂowsof requests. A po-
tential drawback of our approach is that we loose the possibility of customizing
the adaptation action foreach request. However, inthe scenario we consider,
performing aper-requestrather than aper-ﬂowadaptation could cause an ex-
cessive computational burden. For example, the Amazon e-commerce platform,
described in [12], comprises hundreds of services and tens of millions requests,
which make the per-request approach hardly feasible. In addition, our per-
ﬂow approach allows us to deal simultaneously with diﬀerent ﬂows of requests,
each with possibly diﬀerent dependability requirements, thus possibly allowing a
better balancing among diﬀerent ﬂows in the use of the available third-party
services.
We present our approach from the perspective of a composite SOA system
provided by an intermediary broker. The broker composes, according to some
business logic, functionalities implemented by third-party services to oﬀer a new
added-value service. In doing this, it wants to guarantee to its users a given
dependability level, maximizing at the same time an utility function (e.g. its
income).
To achieve these goals within a changing environment (as it is typically the
case for SOA systems), the broker adapts the system it manages in response
to detected events. To this end, the broker maintains a model of the composite
service it oﬀers and of its environment, keeping it up to date thanks to a con-
tinuous monitoring activity. This model is used to determine adaptation actions
in response to detected changes.
The events that may trigger an adaptation include both “normal” events
like the arrival or departure of a user (with the related dependability require-
ments), and “abnormal” events like the unreachability of a component service
or a relevant change of its QoS attributes. The adaptation actions performed
by the broker are based on both the service selection and architecture selection
mechanisms. Indeed, the broker can adapt the composite service it oﬀers by

Towards Self-adaptation for Dependable Service-Oriented Systems 27
redeﬁning the binding between incoming requests and component services (ser-
vice selection), and by restructuring the composite service architecture
(architecture selection).
We formulate the problem of determining the adaptation action triggered by
some event as a Linear Programming (LP) optimization problem, which can be
eﬃciently solved via standard techniques, and is therefore suitable for making
runtime decisions. We have presented apreliminary version of this LP-based
approach in [13]. However, in that paper we only considered service selection
as the adaptation mechanism, while the problem formulation proposed in this
paper considers also the modiﬁcation of the service architecture.
The paper is organized as follows. In Sect. 2 we present a possible architec-
ture of a self-adaptable SOA system that implements our proposed adaptation
methodology. In Sect. 4 we present a mathematical formulation of the system
model used to determine the adaptation actions, and discuss how to calculate
the value of the dependability and cost attributes used in this model. In Sect. 5
we present the results of some numericalexperiments. In Sect. 6 we discuss re-
lated work. Finally, we draw some conclusions and give hints for future work in
Sect. 7.
2 General Architecture
In this section, we deﬁne the composite service model we refer to, and the type of
contract used for the speciﬁcation of therespective obligations and expectations
of the service users and providers. Then, we outline the architecture of the broker
that manages the composite service and its adaptation.
2.1 Composite Service
The system managed by the broker consists of a composite service, i.e., a com-
position of multiple services in one logical unit in order to accomplish a complex
task. The composition logic can be abstractly deﬁned as an instance of the
following grammar:
S::=S1|S2|...|Sn|seq(S+)|loop(S)|sel(S+)|par and(S+)|paror(S+)
whereSidenotes a single service, whileS+ denotes a set of one or more services.
Hence, a composite service can be either a single service, or the composition of
other services according to the composition rules:seq,loop,sel,parand, paror.
Table 1 summarizes the intended meaning of these rules. We point out that the
above grammar is purposely abstract, as it intends to specify only the structure
of a composite service. Details such as how to express the terminating condition
for a loop are therefore omitted. The grammar does not capture all the possible
composition rules (a broader set of composition rules is presented, for exam-
ple, in [14]), but includes a signiﬁcant subset. Table 1 also shows the mapping
between these rules and the constructs oftwo well known service workﬂows spec-
iﬁcation languages: BPEL [15] and OWL-S [16]. For BPEL, the mapping refers

28 V. Cardellini et al.
Table 1.Meaning of the grammar rules and mapping with the constructs of BPEL
and OWL-S
Rule Meaning BPEL OWL-S
seqsequential execution of activitiessequence Sequence
looprepeated execution of activitieswhile, Repeat-While,
in a loop repeatUntil,Repeat-Until
forEach
selconditional selection of activitiesif-elseif- If-Then-
else Else
switch
parandconcurrent execution of activitiesflow Split-Join
(with complete synchronization)
parorconcurrent execution of activitiespick, forEach Choice
(with 1 out ofnsynchronization)
Fig. 1.An example of composite service instance derived form the proposed grammar,
and its graphical representations: the syntax tree (left); the activity diagram (right)
to the structured style of composition (rather than to its graph-based one, using
control links). Figure 1 shows a composite service instance that can be derived
from this grammar, and the corresponding graphical representation in form of
a syntax tree and activity diagram. From a semantic viewpoint, the instance
shown in Fig. 1 abstractly represents the business logic of a composite service,
where eachSidenotes a functionality (abstract service) needed to carry out its
overall task. Each abstract service must then be bound to aconcrete servicethat
actually implements it. The overall dependability and cost of the composite ser-
vice thus depend on the dependability and cost of the concrete services bound to
its abstract services. In our approach, we assume that the involved parties state
the required values for these attributes in a contract, whose schema is outlined
in the next subsection.
2.2 Contract Deﬁnition
As usual in the SOA environment, we assume that the interactions between ser-
vice requesters and service providers areregulated by a Service Level Agreement

Towards Self-adaptation for Dependable Service-Oriented Systems 29
(SLA
expectations [17]. This contract speciﬁes the conditions for service delivery, in-
cluding the quality and quantity levels (e.g., the load that the user can charge)
of the provided service, its cost, duration, and penalties for non-compliance.
According to what discussed in the introduction, we consider in our approach
SLAs stating conditions that should hold globally for aﬂowof requests generated
by a user.
In general, a SLA may include a large set of parameters, referring to diﬀerent
kinds of functional and non-functional attributes of the service, and diﬀerent
ways of measuring them (e.g., averaged over some time interval) [18,17]. In this
paper, we restrict our attention to theaverage valueof the dependability at-
tribute, globally experienced by all therequests belonging to the ﬂow generated
by a user. Hence, the SLA model we consider includes the following quantities:
–amin: a lower bound on the service average dependability expected by a
service user;
–L: an upper bound on the load the user is allowed to submit to the service,
expressed in terms of average rate of service invocations (invocations/time
unit);
–c: the unitary service cost paid by the user for each submitted request.
The broker that manages the composite service acts as an intermediary between
the users of the composite service and the providers of the used component
services, performing a role of service provider towards its users, and being in
turn a user for the providers of the concrete services it uses to implement the
composite service itself. Hence, it is involved in two types of SLAs, corresponding
to these two roles: we call themSLA-P(provider role) andSLA-R(requester
role). Both these SLAs are deﬁned according to the triple described above,i.e.,
SLA-P=SLA-R=αamin,L,cβ.
In the case of the SLAs-P between the composite service users and the broker,
we assume in our approach that the value of their parameters is the result of an
individual negotiation between each prospective user and the broker. Hence, all
theSLAs-Pthatco-existatagiventimeinterval may have, in general, diﬀerent
values for these parameters. However, it is possible that the broker proposes to its
users a predeﬁned set of diﬀerentiated service levels, to drive the user indication
of a service level, but this does not change the formulation of our problem.
In any case, all the co-existing SLAs-P deﬁne the dependability objectives
that the broker must meet in that interval, provided that the ﬂow of requests
generated by the users in that interval does not exceeds the limits stated by the
Lvalues in the SLAs-P. Moreover, they also deﬁne the expected income for the
broker.
To meet these objectives, we assume that the broker has already identiﬁed
for each abstract serviceSia pool of corresponding concrete service, negotiating
with each of them a SLA-R concerning its dependability and cost, and the load
it is able to sustain.
Thus, the set of all these SLA-R deﬁnes the constraints within which the
broker can organize an adaptation policy.

30 V. Cardellini et al.
Workflow
Engine
Composition
Manager
Adaptation
Manager
Execution
Monitor
Admission
Control
Manager
SLA
Monitor
Service
Registry
SLA-R
QoS-Broker
Fig. 2.Broker architecture
2.3 Broker Architecture
To carry out its task, the broker architecture is structured around the following
components, as depicted in Fig. 2: theComposition Manager,theWorkﬂow
Engine,theAdaptation Manager,theExecution Monitor,theAdmission Con-
trol Managerand theSLA Monitor. Our general broker architecture is in-
spired to existing implementation of frameworks for Web services QoS brokering,
e.g., [19,20,17]. In what follows, we summarize the respective tasks of the broker
architecture components.
Composition Manager.The main functions of the Composition Manager are
the service composition (i.e., the speciﬁcation of the business process, whose
structure can be abstractly described by a labeled syntax tree generated by
the grammar in Sect. 2.1), the discovery of the component concrete services
and the negotiation and establishment of the SLAs with the providers of the
concrete services (SLA-R).
Workﬂow Engine.The Workﬂow Engine is the software platform executing
the business process (e.g., ActiveBPEL or ApacheODE). Once a user has
been admitted with an established SLA, the Workﬂow Engine acts as the
broker front-end to the user for the service provisioning. When the user in-
vokes the process, the Workﬂow Engine creates a new instance of the process
itself. Each generated instance can be diﬀerent, according to the instructions
received by the Adaptation Manager (described below). For example, the
service request of users having diﬀerent SLA-P could be bound to diﬀerent
concrete services. Moreover, the workﬂow structure can also be modiﬁed.
Execution Monitor.The Execution monitor collects information about the
composite service usage, calculatingestimates of the model parameters. In
our methodology, the only needed parameters are the invocation frequencies
of the functionalities (abstract services) used to build the composite service.
SLA Monitor.The SLA Monitor collects information about the dependability
level perceived by the users and oﬀered by the providers of the used com-
ponent services, and about the mean volume of requests generated by the

Towards Self-adaptation for Dependable Service-Oriented Systems 31
users. Furthermore, the SLA Monitor signals whether there is some variation
in the pool of service instances available for a given abstract service (i.e., it
notiﬁes if some service goes down/isunavailable). In literature, there are
examples of SLA Monitors managed/owned by the broker [19,20,17] as well
as of third party SLA monitors. In our speciﬁc case, we consider an SLA
monitor directly managed by the broker.
Admission Control Manager. The Admission Control Manager determines
whether a new user can be accepted, given the associated SLA-R, without
violating already existing SLA-Ps and SLA-Rs.
The latter three modules (i.e., Execution Monitor, SLA Monitor, and Admission
Control Manager) collectively play a two-fold role. On the one hand, they main-
tain up to date the parameters of the model of the composite service operations
and environment. These parameters include the invocation frequencies of the
abstract services, the rate of arrival of service requests, the dependability and
cost of the used concrete services.
On the other hand, when these modules observe signiﬁcant variations in the
model parameters, they signal these events to the Adaptation Manager. Summa-
rizing, the Admission Control Manager signals events related to the ﬂuctuation
of workload intensity parameters (the arrival or departure of users, with the
consequent variation in the incoming ﬂow of requests, according to what stated
in their SLAs), while the Execution Monitor signals abnormal ﬂuctuation in the
composite service usage, and the SLA Monitor signals abnormal events, such as
unreachability of a concrete service and variation of its dependability level.
Adaptation Manager.Upon receiving a notiﬁcationof a signiﬁcant variation
of the model parameters, the Adaptation Manager ﬁnds out whether an
adaptation action must be performed. To this end, it executes the adaptation
algorithm, passing to it the new instance of the system model with the new
values of the parameters. The calculated solution provides indications about
the adaptation actions that must be performed to optimize the use of the
available resources (i.e., the concrete services) with respect to the utility
criterion of the broker. Based on this solution, the Adaptation Manager
issues suitable directives to the Workﬂow Engine, so that future instances
of the business process will be generated according to these directives. The
possible adaptation actions, already outlined in the introduction, are detailed
in the following section.
2.4 Adaptation Actions
We recall from the introduction that in our approach the broker deals simul-
taneously with users having diﬀerent requirements stated in the corresponding
SLAs-P. Each request for the composite service coming from a user generates a
corresponding set of one (or more) requests for each abstract serviceSi.These
latter requests must be bound to suitable concrete servicesSi.j,1≤j≤ni.
A ﬁrst action used by the broker to fulﬁll the SLAs negotiated with its users is
based onservice selection, which leads to binding each request forSito a single

32 V. Cardellini et al.
Si.j. In most of the current literature on service selection, where single service re-
quests are considered in isolation (e.g.,[21,11]), this action consists in a0-1 choice
of one concrete serviceSi.jfrom the available ones. In our approach, instead, we
consider simultaneously all the requests belonging to the ﬂow generated by each
service user. Hence, the service selectionactionconsistsindetermining, for each
abstract serviceSi,whichisthefractionof the overall set of requests generated
forSiby a user that will be bound to a given concrete serviceSi.j. Abstractly,
this adaptation action can be represented by the introduction of a probabilistic
switch in the abstract serviceSi, which routes toward theSi.j’s requests arriving
toSiaccording to a suitable set of probabolities, as depicted in Fig. 3(a).
Fig. 3.Adaptation actions
We point out that, as the broker deals simultaneously with several users having
diﬀerent requirements, each user will have its own switch for eachSi. Hence,
requests coming from diﬀerent users will belikely routed diﬀerently. For requests
coming from the same user, it is possible as a special case that the switch routes
all the requests forSitoasingleSi.j, but in general the service selection allows
to route subsets of these requests to diﬀerentSi.j’s.
As already outlined in the introduction, dynamic service selection is the
primary adaptation actions consideredin several papers on SOA systems. How-
ever, it is possible that a user arrives with high dependability requirements,
which cannot be satisﬁed by any selection of the single concrete services already
identiﬁed by the broker. Rather than rejecting this user (which could cause an
income loss and/or a decrease in the broker reputation), the broker could try
other possible actions:
1. To identify additional concrete services, with higher dependability;
2. To “increase” the dependability which can be attained using the already
identiﬁed concrete services.
The former action has two drawbacks. It requires additional eﬀort to discover
such services and negotiate with them suitable SLAs. Worse yet, such services
could not even exist.

Towards Self-adaptation for Dependable Service-Oriented Systems 33
The latter action does not suﬀer from these drawbacks. It is based on the idea
that the availability of multiple independent implementationsSi.1,Si.2,...,Si.ni
of an abstract serviceSinaturally suggests the use ofspatial redundancytech-
niques to get a dependability increase [22]. According to these techniques, a
request forSiis logically bound to a set of two or moreSi.j’s, rather than to a
singleSi.j. Diﬀerent spatial redundancy techniques can be devised, which diﬀer
in the way the members of the set are used and in the assumed underlying fail-
ure model. In this paper, we consider one of such techniques, which works under
thefail-stopfailure model (i.e., either a service responds correctly when it is
invoked, or does not respond at all [1]). According to this technique, a request
forSiis sent in parallel to two or moreSi.j’s, taking as correct reply the ﬁrst
one which arrives. This increases the likelihood that the functionality associated
withSiis correctly carried out with respectto the case where a single concrete
service is used, but at a higher cost, equal to the sum of the costs of all the
invoked services. We refer to [22,14,23] for a description of other spatial redun-
dancy techniques which works under the same or diﬀerent failure models (e.g.,
Byzantine failures).
The use of this adaptation action represents a form of adaptation based onar-
chitecture selection, as it basically corresponds to a modiﬁcation of the workﬂow
architecture, as depicted in Fig. 3(b
stract serviceSiis substituted by a composite serviceparor(Si.a,Si.b,...), where
eachSia,Sib,...will be bound to a diﬀerent concrete serviceSi.j.
In our approach, these two actions (service selection and architecture selec-
tion) can be used by the broker to dynamically adapt the SOA system it manages
to changes in its operating environment. We remark that these actions can co-
exist, being used by the broker not only for the requests of diﬀerent users, but
also for diﬀerent requests of the same user.
In the next section we deﬁne formallya mathematical model of the SOA sys-
tem, and the corresponding optimization problem that can be eﬃciently solved
by the Adaptation Manager component. The calculated solution allows driving
the selection of the appropriate adaptation actions.
3 Adaptation Model
Given the grammar proposed in Sect. 2.1, that speciﬁes the structure of the com-
posite service, we can use it to deﬁne an instance of the composite service and
represent the instance through a labeled syntax tree. The tree leaves constitute
the set of abstract servicesSithat have been identiﬁed by the Composition Man-
ager to build the composite service; we denote byVthis set. GivenV, we assume
that it is known the usage proﬁle of the composite service for each userk,ex-
pressed by the quantitiesV
k
i
,i∈V.V
k
i
denotes the average number of times the
broker invokesSito fulﬁll a request received from the userk∈K,whereKis the
set of users which have a SLA-P with the broker. Therefore, we can label each leaf
of the syntax tree, that representsSi, with a proper vectorVi=(V
1
i
, ... ,V
|K|
i
)
(an example of a labeled syntax tree is shown in Fig. 1). For eachSi,the

34 V. Cardellini et al.
Composition Manager identiﬁes (e.g., by using information from service reg-
istries) a setIi={Si.1,...,Si.ni}of concrete services that implement it.
Each concrete serviceSi.jis characterized by its own dependability levels and
cost. Hence, the SLA-R contracted by the broker with eachSi.jis speciﬁed by
an instance of the general SLA template described in Sect. 2.2 and deﬁned by
the tupleﬀaij,Lij,cijﬃ,whereLijis the average load that the broker has agreed
to generate towardsSi.j. On the other hand, we denote byﬀA
k
min
,L
k
,C
k
ﬃthe
parameters of the SLA-P concerning a userk∈K,whereL
k
is the agreed
volume of requests the user will submit to the broker.
In our broker architecture, the Adaptation Manager is responsible for de-
termining the adaptation strategy which, for the given system model and the
current parameters values, optimizes a suitable broker utility function while
meeting the users dependability constraints.
For each user, the adaptation strategy consists in determining for each ab-
stract serviceSi:
1. The adaptation action (service selection, architecture selection or both) to
be used;
2. The fraction of each ﬂow of requests forSito be bound to the diﬀerent
concrete services for each considered adaptation action.
We model a given strategy by associating with each userka vectorx
k
=
(x
k
1,...,x
k
N
), whereN=|V|andx
k
i
=[x
k
iJ
], withJ∈Pi=2
Ii
\∅,i.e.,J
is a non-empty subset ofIi. Hence, indexiofx
k
iJ
ranges over the set of abstract
services, whileJranges over all the non-empty subsets of the concrete services
implementingSi.
For each abstract serviceSi,theentriesx
k
iJ
ofx
k
i
denote the fraction of
the userkrequests which are bound to the set of concrete servicesJ.Wecan
distinguish two cases:
–J={Si.j},i.e.,Jis a singleton: in this case, the entryx
k
iJ
denotes the
fraction of requests forSito be bound to the single concrete serviceSi.j∈Ii,
thus using service selection as adaptation action;
–J={Si.j1,...,Si.jﬀ
},ﬀ>1,J∈Pi:inthiscase,theentryx
k
iJ
denote the
fraction of requests forSito be bound to the set of concrete services{Si.j1,
...,Si.jﬀ
}, thus using architecture selection as adaptation action (indeed, this
action corresponds to the replacement ofSibypar or(Si.j1,...,Si.jﬀ
)).
As an example, consider the case of four concrete servicesSi.1,...,Si.4for a
given serviceSiand assume that the strategyx
k
i
for a given userkspeciﬁes the
following values:x
i.{Si.1}=0.3,x
i.{Si.3}=0.3,x
i.{Si.2,Si.4}=0.4andxi.J=0
otherwise. This strategy implies that 30% of userkrequests for serviceSiare
bound to serviceSi.1, 30% are bound to serviceSi.3while the remaining 40%
are bound to the redundant pair{Si.2,Si.4}(see Fig. 4).
The Adaptation Manager determines the values ofx
k
iJ
by solving a suitable
optimization problem which takes the following general form (the explicit form
of the problem we consider will be detailed in Sect. 4):

Towards Self-adaptation for Dependable Service-Oriented Systems 35
Fig. 4.Example of adaptation strategy
maxF(x)
subject to:Q
α
(x)≤Q
α
max
(1)
Q
β
(x)≥Q
β
min
S(x)≤L
x∈A
wherex=(x
1
, ...,x
|K|
) is the decision vector,F(x) is a suitable broker objective
function,Q
α
(x)andQ
β
(x) are, respectively, those QoS attributes whose SLA
values are settled as a maximum and a minimum,S(x) are the constraints on
the oﬀered load determined by the SLAs with the service providers, andx∈A
is a set of functional constraints (e.g., this latter set includes the constraint
α
J∈Pi
x
k
iJ
=1).
A new solution of the optimization problem may be triggered when:a)the
Execution Monitor identiﬁes some change in the average number of visits to the
abstract services;b) the service composition changes, because either an abstract
service or a concrete service is added or removed;c) the SLA Monitor detects
some violation in the negotiated SLA parameters;d)anewuser,whichdoesnot
have yet a SLA with the broker, asks for the composite service.
The solution of the optimization problem is used by the Adaptation Manager
to determine for each invocation of an abstract serviceSithe adaptation action
to be used - service or architecture selection - and the actual service(es
implement it by using the vectorsx
k
i
. To bind the requests to the concrete
services, the Workﬂow Engine uses the solution of this optimization problem as
follows. Given a userkrequest, the Workﬂow Engineconsiders only the elements
of the solution vectorxthat pertain to a given userk. If, for each abstract
serviceSi, there is more than onex
k
iJ
= 0, the Workﬂow Engine partitions the
ﬂow of requests forSiamong diﬀerent (subsets of) concrete services, using the
x
k
iJ
values.
4 Optimization Problem
In this section we ﬁrst present the QoS model for the composite service and
how to compute its QoS attributes. We then detail the instance of the general

36 V. Cardellini et al.
optimization problem previously outlined. In the following, since dependability
measures of a composed service are given the product of the individual depend-
abilities, we will consider the logarithm of the expected dependability in order
to have all aggregate QoS a linear function of the component QoS.
4.1 Composite Service QoS Metrics
For each userk∈K, the QoS attributes, namely, the expected logarithm of the
dependabilityE
k
=logA
k
, which is the logarithm of the probabilityA
k
that the
composite service is either available or reliable for a userkrequest and the expected
execution costC
k
, which is the price to be paid by the broker to fulﬁll a userk
request, depend on: 1) the set of concrete services selected to perform each service;
and, 2) how the services are orchestrated to provide the composite service.
To compute these quantities, we ﬁrst compute the expected QoS metric of
an abstract service. LetZ
k
i
(x) denote the QoS attribute of the abstract service
i∈V,Z∈{E,C}for a strategyx.WehaveZ
k
i
(x)=
ﬀ
J∈Pi
x
k
iJ
z
k
iJ
wherez
k
iJ
,
z∈{e, c}is function of the QoS attributesof the concrete services in the set
Jwhich are used to implementi. We can distinguish two cases, corresponding
to the two diﬀerent adaptation actions that can be used (service selection or
architecture selection):
–J={Si.j}i.e., serviceiis implemented by serviceSi.j,wesimplyhave
eiJ=logaijandciJ=cij,i.e., the QoS attribute coincides with that of the
selected concrete serviceSi.j;
–J={Si.j1, ..., Si.jﬀ},ﬀ>1, serviceiis implemente by the set{Si.j1,...,Si.jﬀ
}
in spatial redudancy and we have:
eiJ=log
ﬃ
1−
≤
≤
h=1
(1−aijh
)
∈
(2)
ciJ=
≤
∅
h=1
cijh
(3)
The expression foreiJ, which represents (the logarithm of) the probability that
the composite servicepar or(Si.j1,...,Si.jﬀ
)terminates successfully, is given by
(the logarithm of) the complement to one of the probability that all concrete
services inJfail. The costciJis simply the sum of the cost of the invoked
services, since for each invocation ofiall the concrete service inJare invoked.
The QoS attributes for the composedservices can be computed by properly
aggregating the corresponding QoS attributes of the constituend servicesi[24].
Since the cost and (logarithm of the) dependability are additive [24] QoS metrics,
for their expected value we simply obtain
E
k
(x)=
∅
i∈V
V
k
i
E
k
i
(x)=
∅
i∈V
V
k
i
∅
J∈Pi
x
k
i.J
eiJ (4)
C
k
(x)=
∅
i∈V
V
k
iC
k
i(x)=
∅
i∈V
V
k
i
∅
J∈Pi
x
k
iJci.J (5)

Towards Self-adaptation for Dependable Service-Oriented Systems 37
whereV
k
i
is the expected number of times serviceiis invoked for a classk
request.
4.2 Optimization Model
In this section we detail the instance of the general optimization problem outlined
in Sect. 3. By solving this problem, the Adaptation Manager determines the
variablesx
k
iJ
,i∈V,k∈K,J∈Piwhich maximize a suitable objective function
given the user QoS and system constraints.
We assume that the broker wants, in general, to deﬁne an adaptation strat-
egy which optimize multiple - possibly conﬂicting - requirements; therefore,
the adaptation strategy results in a multi-objective optimization. We tackle
the multi-objective problem by transforming it into a single objective problem
through the weighted sum approach, which is the most widely used scalarization
method. To this end, we deﬁne as the broker utility functionF(x)theweighted
sum of the (normalized) QoS attributes of all users which can be regarded as
an overall aggregate QoS measure for the oﬀered service. More precisely, let
Z(x)=
1
α
k∈K
L
k
α
k∈K
L
k
Z
k
(x), whereZ∈{E,C}is the expected overall
dependability and cost, respectively. We deﬁne the broker utility function as
follows:
F(x)=we
E(x)−Emin
Emax−Emin
+wc
Cmax−C(x)
Cmax−Cmin
(6)
whereweandwc(we,wc≥0,we+wc= 1) are weights for the diﬀerent QoS at-
tributes. Here,Emax(Emin)andCmax(Cmin) denote, respectively, the maximum
(minimum) value of the aggregated dependability (cost) (We will describe how
to determine these values shortly).F(x) takes values in the interval [0,1]. As-
sumingwe,wc=0,F(x)=1whenE(x)=EmaxandC(x)=Cmin,i.e.,when
the aggregate dependability is maximized and the cost minimized;F(x)=0
whenE(x)=EminandC(x)=Cmax,i.e., when the aggregate dependability is
minimized and the cost maximized.
The problem solved by the Adaptation Manager consists in ﬁnding the vari-
ablesx
k
iJ
,i∈V,k∈K,J∈Pi, which maximizes the broker utilityF(x). This
is accomplished by solving the following linear optimization problem:
maxF(x)
subject to:C
k
(x)≤C
k
max
k∈K (7)
E
k
(x)≥E
k
min
k∈K (8)
∅
k∈K
∅
J∈Pi
x
k
iJ
V
k
i
L
k
≤Liji∈V,j∈Ii (9)
x
k
iJ
≥0,J∈Pi(j),
∅
J∈Pi
x
k
iJ
=1i∈V,k∈K (10)
Equations (7)-(8) are the QoS constraints.E
k
min
=logA
k
min
is the logarithm of
userkminimum expected service dependability.C
k
maxis the maximum cost the

38 V. Cardellini et al.
broker is willing to pay to fulﬁl a userkrequest. We assumeC
k
max
≤C
k
,where
C
k
is the cost the broker charge userkfor each service request as deﬁned by user
kSLA-P. Equations (9) are the SLA-R constraints and ensure that the broker
does not exceed the volume of invocations agreed with the service providers.
The left hand side in (9) is indeed the volume of requests which are bound to
serviceSi.jandLi.jthe agreed upon value in the SLA-R. Finally, (10) are the
functional constraints.
We observe that the proposed optimization problem is a Linear Programming
problem which can be eﬃciently solved via standard techniques. The solution
thus lends itself to both on-line and oﬀ-line operations. The problem can be ex-
tended to account for other QoS attributes,e.g., the service time and reputation
(see [13] for details). Is it worth noting that also in these cases the optimization
problem can be cast as a Linear Programming problem.
We conclude describing on how to compute the maximum and minimum val-
ues of the QoS attributes in the objective function.EminandCmaxare simply
expressed respectively in terms ofE
k
min
andC
k
max. For example, the maximum
cost is given byCmax=
1
∈
k∈K
L
k
∈
k∈K
L
k
C
k
max. Similar expression holds for
Emin.ThevaluesforEmaxandCminare determined by solving a modiﬁed opti-
mization problem in which the objective function is the QoS attribute of interest,
subject to the constraints (9)-(10).
5NumericalExperiments
In this section, we illustrate the behavior of the proposed adaptation strategy
scheme through the simple abstract workﬂow of Fig. 1.
For the sake of simplicity we assume that the broker has established just two
SLA-Rs for each service except for serviceS2for which there are 4 established
SLA-Rs. The diﬀerent SLA-Rs diﬀer in terms of cost and dependability. Tables 2
summarizes the parameters as deﬁned by the SLA-R∈aij,cij,Lijﬃfor each con-
crete serviceSi.j. They have been chosen so that for each abstract serviceSi∈V,
concrete serviceSi.1represents thebetterservice, which at a higher cost guar-
antees higher dependability with respect to serviceSi.2, which costs less but has
lower dependability. For all services, we assumeLij= 10.
In Table 3 we also list the QoS parameters associated with sets of concrete
servicesSi.js used in spatial redundancy according to the fail stop failure model,
i.e., the QoS associated to the constrctparor(Si.1,...,Si.≤). The values are com-
puted from those of the constituent services using (2)-(3). We assume the broker
has established SLA-Ps with 4 users which are characterized by a wide range
of dependability requirements as listed in Table 4. Users are ordered according
to the required minimum level of dependability, with User 1 having the high-
est requirement,A
1
min
=0.995, and User 4 the least requirementA
4
min
=0.9.
The SLA-Ps costs have been set accordingly with User 1 incurring the highest
cost per request,C
1
= 25, and User 4 onlyC
4
= 12. We consider the following
values for the the expected number of service invocations of the diﬀerent users:
V
k
1=V
k
2=V
k
3=1.5,V
k
4=1,k∈K,V
k
5=0.7,V
k
6=0.3,k∈{1,3,4},k=2,

Towards Self-adaptation for Dependable Service-Oriented Systems 39
Table 2.Concrete services QoS attributes
Serv.cijaij
S1.160.999
S1.230.99
S2.140.999
S2.220.99
S2.34.50.99
S2.410.95
S3.120.999
Serv.cijaij
S3.210.99
S4.10.50.999
S4.20.30.99
S5.110.999
S5.20.70.99
S6.10.50.999
S6.20.20.99
andV
2
5=V
2
6=0.5. In other words, all users have the same average number of
service invocations except for user 2, which invokes the services 5 and 6 with dif-
ferent probabilities from the other users. We illustrate the adaptation strategies
under two diﬀerent scenarios: 1) the broker minimizes the average cost (wc=1);
and 2) the broker maximizes the average dependability (we= 1). The results
are summarised in Fig. 5 and 6 which shows the solutions for the two scenarios
for User 1 and User 4, respectively; in Table 5 we list the resulting QoS metrics
for all the users.
In the ﬁrst scenario, the broker goal is to minimize the expected cost (which in
turn maximizes the broker proﬁt). In this setting the broker has no incentive to
guarantee to the user more than the minimum required. As a result the solution
provided by the Adaptation Manager guarantees only the minimum required level
Table 3.QoS attributes for the fail stop redundant services
Redundant Serv. ciJ eiJ
paror(S1.1,S1.2) 9 log(0.99999)
paror(S1.1,S1.3) 6 log(0.99999)
paror(S2.1,S2.3) 8.5log(0.99999)
paror(S2.1,S2.4) 5 log(0.99995)
paror(S2.2,S2.3) 6.5log(0.9999)
paror(S2.2,S2.4) 3 log(0.9995)
paror(S2.3,S2.4) 5.5log(0.9995)
paror(S2.1,S2.2,S2.3)10.5log(0.9999999)
paror(S2.1,S2.2,S2.4)7log(0.9999995)
paror(S2.1,S2.3,S2.4)9.5log(0.9999995)
paror(S2.2,S2.3,S2.4)7.5log(0.999995)
paror(S2.1,S2.2,S2.3,S2.4)11.5log(0.999999995)
paror(S3.1,S3.2) 3 log(0.99999)
paror(S4.1,S4.2) 0.8log(0.99999)
paror(S5.1,S5.2) 1.7log(0.99999)
paror(S6.1,S6.2) 0.7log(0.99999)

Other documents randomly have
different content

often there has been slight constipation, and exceptionally there has been irregular diarrhœa.
In other words, no causative relationship or parallelism could be observed between the
emptying of the intestinal tract and the development of scurvy. This in general has been the
experience of others. In the report of the American Pediatric Society the bowels are stated as
having been regular in 74 cases, irregular in 15, constipated in 126, and diarrhœal in 65. It
may be added that we were unable to cure scurvy by means of liquid petrolatum or
phenolphthalein, either in infants or in guinea-pigs, and likewise unable to protect guinea-
pigs from scurvy by means of various laxatives. On the other hand, opium given in the form
of the camphorated tincture did not lead to an intensification of the symptoms, although, in
one case, the bowels did not move for over three days.
As complications involving the gastro-intestinal tract may be mentioned the vomiting of
blood, which is stated in the above report as occurring in 2 of the 361 cases, as well as
bleeding from the bowel, which was noted in 37 cases, in 12 of which there was bloody
diarrhœa. However, these are late symptoms, and correspond to the mycotic ulcers which are
so frequently found, especially in the large intestine, in cases of scurvy. Mention may again
be made of the fact that hemorrhages may occur under the peritoneum and give rise to
symptoms simulating appendicitis or general peritonitis.
Jaundice has been described in connection with certain epidemics of scurvy. To our
knowledge it has not been reported in infants.
The presence of worms has been frequently reported in the bowel or in the stool of patients
suffering from beriberi. There have been no similar investigations in relation to scurvy. It
would be interesting to inquire into this question, as it is quite possible that a lack of
antiscorbutic foodstuff may favor the presence of parasites in the intestinal canal.
Before closing this consideration of the involvement of the alimentary tract, we would call
attention to the relation of stomatitis to scurvy. Among adults this is a common complication.
In infants it is uncommon, due to the absence of carious teeth and secondary infection; we
have encountered it in but two instances. Stomatitis is of importance in this connection, as it
frequently develops on the basis of malnutrition, scurvy being one of the disorders which may
constitute the substratum. Such may be the case where stomatitis occurs in epidemic form —
for example, among large bodies of troops. It may be remarked that stomatitis at times was
a very common disease among the soldiers in the recent war.
TABLE 4
ThÉ PäatÉäÉts anÇ OthÉr BäooÇ-CÉääs in Scurvy
NameDatePlateletsLeukocytesErythrocytes
Hmgl. %
(Sahli)
Remarks
M. H. 5/  3 280,000 ...... ......... ..
5/  4 248,000 10,000 ......... ..
5/  5 ....... ...... ......... .. Boiled orange juice given.
5/  8 ....... ...... 4,300,000 35
5/16.......15,900 ......... ..
7/  2 ....... 6,800 5,456,000 40 Well but pale.
A. L. 5/  3 300,000 ...... ......... ..
5/  5 .......21,000 ......... ..
5/  9 ....... ...... 5,480,000 ..

5/11320,000 ...... ......... ..
5/13....... ...... ......... 65
5/16.......11,500 ......... ..
H. C. 5/  8 320,000 20,000 ......... ..
5/  9 ....... ...... 5,340,000 ..
5/13....... ...... ......... 70
5/16362,000 ...... ......... ..
B. B.5/  4 496,000 21,000 ......... .. A severe case.
5/13585,000 14,000 3,200,000 70
5/18.......17,600 ......... ..
7/13.......40,000 7,672,000 82 Has gained well lately.
7/15....... ...... 7,640,000 88
H. Y.5/15560,000 ...... ......... ..
5/16424,000 ...... ......... ..
7/  9 ....... ...... 5,750,000 45
Scurvy is associated with an alteration of both the blood and the blood-vessels. The
characteristic pallor, which is one of the most common as well as earliest symptoms, is due in
a large measure to the anemia. This anemia is of the secondary type, but has definite
peculiarities, and does not resemble that encountered in the course of tuberculosis, rickets or
marasmus. The hemoglobin is greatly diminished, far out of proportion to the decrease in the
number of the red cells. Not infrequently we will find a hemoglobin index of 0.5. Table 4,
above taken from the article on this subject by Hess and Fish (1914), brings out the details of
the blood-picture. It shows that there may be a polycythemica, which may persist after the
other signs of the disorder have disappeared. Brandt has recently made similar observations,
reporting in one instance over ten million red cells two months after treatment. In soldiers
suffering from scurvy Wassermann has encountered cases where, during convalescence, the
red-cell count has risen to over six or seven millions and the hemoglobin to 110 or 120 per
cent. Under the microscope the red cells show poikilocytosis, anisocytosis and a lack of
hemoglobin; they are slightly enlarged, with the occasional occurrence of exceptionally large
cells resembling the “dropsical cells” described in connection with chlorosis. Sometimes a few
nucleated red cells and myeloblasts are seen; megaloblasts are also reported.
48
The blood-
picture bears a remarkable similarity to that of chlorosis, a point of interest, in view of the
fact that both scurvy and chlorosis have been attributed to a disordered function of the
endocrine glands. The “dropsical cells” suggest a disturbance of the salt balance in the
plasma. In some cases we have found a decreased fragility of the red cells, which also has
been described in chlorosis.
The total number of leucocytes is slightly increased. In our cases the mononuclear cells have
averaged 66 per cent., which is somewhat high even for infants. This has been the
experience of Labor, who, however, also describes an eosinophilia during convalescence, a
phenomenon which we have not encountered. Some describe a marked increase in the
polynuclear cells, which, probably, is to be regarded as the reaction to secondary infections.
There is indeed a marked difference of opinion in regard to the morphology of the blood in
scurvy in adults as well as in infants. Some found a large number of one type of cell—for
example, nucleated red cells, myelocytes, eosinophiles—whereas others have failed to
observe an increase of these cells. The divergent reports probably should be attributed to the

fact that the investigators are describing scurvy of various grades of severity, of different
stages of development, or complicated by intercurrent disease.
Nobécourt, Tixier, and Maillet have questioned whether there is always complete recovery
from this anemia, which is severe from the standpoint of hemoglobin and iron. The older
authors reported instances where men have been weakly and ailing for the remainder of their
lives after an attack of scurvy. In some infants pallor and anemia may persist for months
after apparent cure; however, this is the exception rather than the rule.
In view of the fact that scurvy frequently is classed as a hemorrhagic disease, and that
hemorrhages play such an important rôle in its symptomatology, a consideration of the
factors concerned in the coagulability of the blood is of interest. In an investigation (Hess and
Fish) it was found that the oxalated plasma (of blood taken directly from a vein) showed a
slightly delayed coagulation time—eight to fourteen minutes. The “bleeding time” carried out
according to the simple method of Duke was slightly increased. Holt reports a case where a
child bled to death following incision into an epiphyseal swelling at the lower end of the
femur. The number of blood platelets is increased, running parallel, as is usually the case,
with the number of red cells (Table 4). This increase in the blood-platelets, recently
confirmed by Tobler and by Brandt, is a very exceptional phenomenon, and was not
anticipated in connection with a disorder characterized by hemorrhage. The antithrombin
content of the plasma is normal.
The investigation was directed to a study of the integrity of the blood-vessels in order to
account for the hemorrhages. To this end the “capillary resistance test” was devised.
49
In the
majority of cases this was found to be “positive” (the blood-vessels showing an increased
permeability) and to become negative when antiscorbutics were given and the symptoms
disappeared. This shows that the cellular structure of the vessels is altered in the course of
scurvy, and indicates probably that this is an important cause of the hemorrhages. The
edema of the face and ankles, the outflow of serum into the body cavities and into the
muscles (Barlow) must be regarded as other evidences of the inadequacy of the vessel walls.
The tendency of children with exudative diathesis to develop scurvy is perhaps still another
manifestation of vascular weakness. This point of view has been strengthened recently by the
pathological studies of Aschoff and Koch, who regard scurvy as a nutritional disorder in which
there is a lack of some colloidal substance needed for the normal structure of the vessels.
When one makes a subcutaneous puncture in infants suffering from scurvy, a small
hemorrhage very often develops at the site of the puncture wound. This is not the case when
one makes a hypodermic puncture in a normal person or in a hemophiliac, although it does
occur in cases of purpura. This “stick test” is not a constant sign of scurvy, but, like the
capillary resistance test, was found in many cases and disappeared with the subsidence of
the disorder. It shows that the cells of the skin and subcutaneous tissues are affected, and
possibly that their thromboplastic power is diminished.
Nutrition and Growth.—The general nutrition suffers in scurvy as the disease progresses.
It is a mistake, however, to picture the scorbutic individual, either adult or infant, as in a
state of malnutrition. Not infrequently he appears well nourished, an appearance which is
heightened by the slight edema of the face. Infants generally for a period of weeks or
months preceding the onset maintain a stationary weight. This may be the only sign of the
scorbutic condition. For example:

An infant seen in 1915 gained about one-half a pound during the months of February,
March, April and May. At this time it was somewhat over 9 months of age and had never
received raw milk or other antiscorbutic food. In June it was given orange-peel juice, and
gained 2 pounds within a month. There were no other scorbutic signs or symptoms, and
no loss of appetite during the months of February and March, although the baby was
suffering from a progressive scurvy.
The growth impulse of the body throughout an attack of scurvy remains unimpaired, being
merely in an inactive or quiescent state. Fig. 14 shows this very well, demonstrating that
when an antiscorbutic food is added to the dietary the gain may be abnormally great—there
may be supergrowth. Generally such marked increases are due to an increase in the
consumption of food, following the stimulation of the appetite. However, decided gain in
weight may follow the giving of orange juice or other antiscorbutic despite the fact that the
intake of food is maintained at the same level.
Fig. 24.—Development of scurvy in spite of normal gain in weight in
a baby who had been underfed since birth.
Although it may be stated as a principle that the development of scurvy is accompanied by a
failure to gain in weight, there are exceptions to this rule. Under certain conditions the
weight may follow a perfectly normal course during the entire period. Fig. 24 illustrates this
clinical paradox:
A baby was seen in January, when it was 7½ months of age. Toward the end of
February, in spite of constant and normal gain in weight, he manifested unmistakable
signs of scurvy—peridental hemorrhage over the upper incisor teeth, which were
erupting, and tenderness of the lower ends of the femora. The scorbutic nature of these
signs were substantiated by their prompt subsidence on the administration of orange
juice. We explain the phenomenon as follows: This baby had been starved in a two-fold
sense throughout the first months of its life—it had received a diet lacking in caloric
value as well as deficient in antiscorbutic vitamine. Its growth impulse had been held in
abeyance for months by both of these factors. When sufficient calories were supplied in
the dietary, growth was no longer repressed, and a steady gain resulted in spite of the
continued inadequacy of the antiscorbutic factor.

It has been shown that during the period of infancy undernourishment must be extreme to
occasion stunting of growth in length. In animals Aron demonstrated that lack of nutrition led
to a decrease of the fat and of the muscle of the body, but that the skeleton nevertheless
continued to grow, and the ash content of the body to increase. In marasmus, or infantile
atrophy, the baby usually grows in length, although its weight remains stationary or
decreases. In scurvy we have shown that there is frequently a definite retardation of growth
in length, an observation which has been recently confirmed by Epstein in babies which
developed this disorder in the foundling asylum of Prague during the war. This fact shows
how profoundly the metabolism must be disturbed by this disorder. Figure 25 portrays this
retardation in growth and the sharp reaction when orange juice was added to the dietary. It
also demonstrates that the growth impulse remains unimpaired and capable of quick
response when the essential food factor is furnished.
Fig. 25.—Showing retardation of growth in length during the period
when no orange juice was given and supergrowth when it was
given once more, O. J.=orange juice. O. P. J.= orange-peel juice.
Lower curve represents the normal.
Fever.—Fever frequently accompanies scurvy. It is generally of a low grade, ranging
between 100° and 101°, as may be seen in Fig. 15. There is a difference of opinion as to
whether the rise of temperature should be considered as truly scorbutic in nature, as
“scorbutic fever,” or regarded merely as a condition grafted upon the nutritional disturbance.
A phenomenon which might seem to argue for its essential scorbutic character is the sharp
subsidence on giving antiscorbutic food. On the other hand, this may quite as well be
interpreted as due to a secondary reaction, checking the absorption of toxins or bacteria.
High temperatures—for example, fever of 103° or over—are attributable to a complicating
infection and should lead to careful examination for the source of the trouble; pyelitis should
particularly be borne in mind. In a recent case fever of uncertain origin disappeared following
the transfusion of blood.
We have already considered numerous complications of scurvy, and shall therefore not go
over this ground again. Many of them are due to hemorrhages or to serous effusions in
various parts of the body. Another large group in adults as well as in infants are the result of
infection. The respiratory tract is particularly susceptible, pneumonia constituting the most
common cause of death. In infants we meet with frequent attacks of “grippe,” widespread
occurrence of nasal diphtheria, furunculosis and torpid ulcers of the skin, pyelitis, otitis,

adenitis, etc. We have encountered nasal diphtheria—with typical bloody mucous discharge—
so frequently in connection with scurvy, that where this local infection occurs among a group
of infants they should be carefully examined for latent or mild scurvy. Aschoff and Koch
recently have laid emphasis on the frequency with which diphtheria complicated scurvy
among adults (soldiers). Dysentery is another complication resulting from an invasion of
bacteria. Local infections occur more often in adults than in infants—cervical adenitis
following gingival pyorrhœa, “bubo” of the groin following infection of the lower extremity,
abscess of the calf of the leg following hemorrhage into this region.
Scurvy sometimes occurs in epidemic form, especially in the army, but also, as in Russia,
among the civilian population. This results when a large group of individuals have been
maintained on a limited and inadequate ration, and especially where this nutritional condition
is complicated by intercurrent infection. It should not be interpreted as evidence of the
bacterial origin of scurvy. A few years ago the author reported an epidemic of scurvy in
connection with an outbreak of grippe in an infant asylum. Twelve infants in one ward were
affected. The signs were atypical—an undue degree of hemorrhage occurring at atypical sites
(Table 5). It will be noted from the table that the ages of the infants, the distribution of the
hemorrhages, the development of signs (in some instances) in spite of antiscorbutic
treatment, the sharply defined epidemic character, distinguish these cases from the scurvy
commonly seen. This is an instance where latent scurvy was prematurely changed to acute
scurvy by an intercurrent ward infection; an epidemic of grippe precipitated a pseudo-
epidemic of scurvy. It is important, especially for army surgeons, to bear in mind that where
latent scurvy exists a bacterial invasion will lend the disorder a hemorrhagic character. This
has been noted during the recent war in connection with typhus fever on the Eastern front,
and was remarked upon during the Crimean War and our War of the Rebellion. Some years
ago Wherry made a similar observation in the course of experiments with the plague bacillus
—guinea-pigs fed on a cereal diet developed far more hemorrhages subsequent to infection
than those which received cabbage in addition.
TABLE 5
Data of EéiÇÉmic of Scurvy
Case
Age,
Mos
Weight
Site of
Hemorrhages
Date Diet Remarks
lbs. oz.
1. J. H. 6½ 9 6Humerus, tibia,
face.
Apr. 19Breast milk (1
week);
pasteurized milk
previously.
Grippe since end
of February;
nephritis; v.
Pirquet negative.
10 4Upper eyelid May 9
2. L. S . 512 14External ear,
parietal bones,
vertebral
column,
abdominal wall
May 4Pasteurized milk
formula; orange
juice 1 oz. daily
since April 22.
Twitchings and
convulsions; signs
of intoxication;
red blood cells in
urine fever to
101° F.; v. Pirquet
negative.
3. A. R. 10 12 8Femur Apr. 19Pasteurized milk
formula;
Grippe end of
January; again in

vegetables for a
month; orange
juice longer;
getting orange
juice and
vegetables.
April; fever until
April 17; v.
Pirquet positive;
gums negative.
Femur again
swollen and
tender.
June  4
4. D. E. 5 7 Both ears;
parietal bones.
Apr. 29Breast milk since
April 19; May 30,
changed to
pasteurized milk.
Grippe throughout
March;
intoxication;
nephritis; no
relapse although
no orange juice
given.
5. T. K. 1015 13Ear and face Apr. 27Pasteurized milk,
cereal,
vegetable, soup;
orange juice
since April 15.
Two teeth; gums
negative; v.
Pirquet negative.
6. P. G. 4 8 4Tibia May  8Pasteurized milk
formula.
Grippe end of
February and first
half of March
gained 20 oz.
during last
month; v. Pirquet
negative.
7. I. P. 2 6 4Abdomen Mar.  7Breast milk for
past week;
pasteurized milk
previously.
Grippe; probable
source of
epidemic.
DIAGNOSIS
A correct and early diagnosis of scurvy is the more important in view of the fact that we
possess a specific remedy, and that the disorder is not self-limited. Recognition generally
presents little difficulties for those who have seen cases, but is a stumbling block where the
symptomatology has been gleaned merely from the textbooks. It has been our experience
that medical students who were conversant with scurvy from a theoretical standpoint failed
to diagnose a case presented to them in the clinic. Where diagnosis is uncertain, the most
important aid is an exact knowledge of the previous diet, and observation of the reaction of
the patient to antiscorbutic treatment. These diagnostic points should be constantly
remembered in relation to the discussion which follows, and will not be reiterated in the
differentiation of scurvy from the various other diseases.
The scurvy of adults and of infants are very similar. The main difference is the subjective
symptoms in the adult—pains in various parts of the body—and the fact that the gums are
frequently the site of infection and ulceration, as well as of hemorrhage. It might be thought

that when scurvy occurs in epidemic form it would be readily recognized, but experience
shows that for months it may permeate the ranks of troops or the inmates of almshouses,
and pass as rheumatism. This is the cardinal diagnostic error in adult as well as in infantile
scurvy—time and again, and in spite of urgent and repeated warnings, patients continue to
be treated for rheumatism. Holt writes: “In fully four-fifths of the cases which have come to
my own notice this (rheumatism) has been the previous diagnosis.” Such has been our
experience. The diagnosis should not be difficult. In sporadic cases, the individual has limited
his diet usually on account of indigestion, or diarrhœa, or following some dietetic whim or
medical advice given months previously. Where scurvy occurs en masse it may follow an
inability to obtain fresh food—as during war, on shipboard, in the Tropics or in the Arctic
regions—or be the result of a misplaced reliance on some article of food—for example,
dehydrated vegetables. More careful investigation will disclose that the “rheumatic” pains and
tenderness are not in the joints but in the muscles and tendons. The calf muscles are
frequently painful and excessively tender and somewhat swollen or infiltrated; the hamstring
tendons or the tendo Achilles may be sore and slightly swollen and the site of slight
subcutaneous hemorrhages. In some cases there is bone tenderness, pain on percussion of
the shins or of the sternum. These signs may be accompanied by, or even precede,
hemorrhages in the gums. The diagnosis of rheumatism in infants indicates a lack of
knowledge of pediatrics, as this disease is hardly ever encountered in babies under a year
and a half of age.
It is not always easy to differentiate scurvy from purpura. In either disease the gums may be
hemorrhagic and swollen, there may be scattered subcutaneous hemorrhages and pains in
the limbs. Occasionally, as in a case seen a few years ago, we may be forced to resort to the
dietetic test. A close inquiry into the previous diet, however, a history of previous attacks of
purpura, the number, and especially the large size, of the subcutaneous hemorrhages, and
above all, the diminished number of blood-platelets, should make diagnosis possible. In
scurvy the platelets are almost always over 300,000 per cubic millimetre, whereas in purpura
they are reduced to less than 200,000.
In the army it may be difficult to distinguish scurvy from beriberi, especially if they occur side
by side as in the recent English campaign in Mesopotamia. There may be a combination of
the two diseases, a picture similar to ship-beriberi, regarded by Nocht as a hybrid of these
diseases. The diagnosis is rendered more difficult, as at times scurvy is associated with signs
of neuritis. We shall have to depend on the involvement of the gums and the hemorrhages in
scurvy, and on the hyperæsthesia, paræsthesia, and anæsthesia in beriberi; marked edema
points to the latter disease.
We have thus far had in mind frank and outspoken cases of scurvy. When we come to
consider latent or early cases, the diagnosis is more difficult and may have to be merely
tentative. All that need be added, in view of the clinical picture sketched above, is that this
condition should not be forgotten in treating adults who have malaise and indefinite
“rheumatic” pains and, more particularly, in relation to infants who fail to gain, whose
appetite is capricious, whose disposition has become fretful and who have developed the
sallow scorbutic complexion. This warning is particularly opportune at present in the United
States, where pasteurized milk is fed so extensively to infants, and an antiscorbutic food is
not always given.
In addition to the symptoms just enumerated, tenderness of the bones, especially of the
distal ends of the femora, should be sought for, the urine should be examined carefully for

red blood-cells, and perhaps the ends of the long bones radiographed for “the white line” of
Fraenkel.
The experience of Comby with infantile scurvy is illuminating. Among the fifty-five cases
which he has seen, the diagnosis was erroneous in forty-five, and among thirteen cases
recently met with, the physician failed to recognize the disorder in all but two. The infants
had been given sodium salicylate, had been treated with electricity and massage for the
supposed acute poliomyelitis, or given mercury for syphilis, or incisions or trephining had
been carried out for acute osteomyelitis. Some had been put into plaster casts for coxalgia or
for Potts’ disease. This experience requires little comment. It should be added, however, that
in the course of an epidemic of poliomyelitis, such mistakes are apt to happen, and, to our
knowledge, did occur in the recent epidemic.
In regard to “the pseudo-paralysis” of congenital syphilis diagnosed as scurvy, it should be
remembered that this lesion occurs almost always before the fifth month of life. A history of
previous papular eruption, the bilateral enlargement of the epitrochlear glands, and the
Wassermann test should suffice to establish the correct diagnosis.
Besides the clinical conditions enumerated above, we may add the following, which have
been confused with scurvy: Neuritis, hemorrhagic nephritis, calculus of the urinary tract,
renal tumor, orbital tumor, appendicitis, peritonitis, pleurisy and pneumonia. Holt writes as
follows: “I have known two cases to be operated upon by eminent surgeons, once with a
diagnosis of sarcoma and once of ostitis of both tibiæ. Not until the subperiosteal
hemorrhages and epiphyseal separations were discovered was the nature of the trouble
suspected.” Recently we saw a case of fracture of the distal end of the femur diagnosed as
infantile scurvy; the baby had caught its thigh between the bars of the crib and snapped the
bone in trying to extricate itself. Finkelstein adds acute endocarditis, hemorrhagic septicæmia
with multiple bone swellings, and leukæmia as having been confused with scurvy.
In an interesting account of scurvy in the Russian army during the recent war, Hoerschelman
states that tired soldiers at times feign scurvy. They produce a “pseudo-scurvy” by means of
scratching the gums with their nails or rubbing them with tobacco, and at the same time
bring about hemorrhages of the skin by means of trauma.
Scurvy in the breast-fed infant has been fully considered under etiology. We wish merely to
state again that one cannot be too cautious in venturing this diagnosis in a nursing baby. The
great majority of reported cases are not scurvy, but bacterial infections, syphilis, or various
forms of intoxication. In establishing a diagnosis the same principles hold as in the case of
bottle-fed infants.
The most important consideration in the diagnosis of scurvy is to keep in mind the
heterogeneous character of its symptoms, and the manifold diseases with which it may be
confused. Surgeons should be alert to this danger when about to perform operations for
osteomyelitis or bone tumor. The mistakes occur because cases are infrequently seen and
because the signs, being dependent largely upon hemorrhage, occur in such varied locations
of the body. Where diagnosis cannot be made from the signs or symptoms, the most
important aid is a thorough acquaintance with the previous diet of the individual and
observation of his reaction to antiscorbutic treatment.

CHAPTER VIII
PROGNOSIS
The outcome of scurvy, as we encounter it in peace time in the Temperate Zone, is generally
favorable, so that it plays but an insignificant rôle in our mortality statistics. This results from
the fact that we are abundantly provided with a specific remedy, so that if the diagnosis is
made early and treatment is prompt and thorough, the patient will rapidly recover and suffer
no physical disability. Where antiscorbutic foodstuffs are not procurable, however, this disease
constitutes a terrible scourge, causing many deaths and spreading among an army, a ship’s
crew, or among the civil population with the rapidity of an epidemic. For example, the ships
of the East India Company in their voyages round the Cape often lost nearly one-half of their
crews, and in Lord Anson’s famous voyage round the world 380 out of 510 seamen perished
from the disease. Moreover, if the antiscorbutic treatment is inadequate or the patient goes
untreated for a long period, the cure may be incomplete, a condition of malnutrition and
weakness developing, which may persist for years. To appreciate this clinical condition we
must refer to the account of physicians who saw thousands of cases of severe and untreated
scurvy among the sailors, who were of necessity deprived of aid until they reached land. Lind
laid stress on a type of this disease which developed under these circumstances and which
he termed “obstinate scurvy.” He writes: “I have met with numerous instances not only
among the common seamen, but of officers, with whom it had taken such deep root in the
constitution as to prove a lasting affliction to them during a great part of their lives. . . .
Persons are likewise subject in different periods of their life afterwards to habitual
rheumatism, pains and stiffness in their joints; and sometimes eruptions on the skin.” In his
treatise on scurvy, published in 1685, Harvey refers to this chronic nutritional disorder as
“inveterate scurvy.” He pictures patients who had gone untreated for a long time as
“molested with vagrant, ambulative, distending, creeping, vellicating or lancinating pains of
several parts of the body. . . . They are often loose and subject to falling into violent fluxes of
the belly, diarrhœa and lienteries.”
Infants as well as adults usually recover rapidly and completely from scurvy, the result
depending largely upon the early recognition of the disease. We must always bear in mind,
however, that from a histologic standpoint the cure is not simultaneous with the magic
disappearance of the clinical symptoms, but that months probably elapse before the tissues
return to their normal state. It is difficult to give reliable mortality statistics for infantile
scurvy, for so many cases are of the rudimentary form that percentages are necessarily
misleading. Still writes that in 5 out of 64 cases the disease proved fatal by diarrhœa and
exhaustion. The American Pediatric Society reports 29 deaths out of 397 cases, which gives a
similar mortality percentage. When infantile scurvy was not so generally recognized by
physicians the mortality was much higher, and we find that Barlow encountered 7 deaths in
his first series of 31 cases.
Even when the child recovers it may not regain its normal health if it has continued for a
prolonged period in a state of chronic scurvy. It may remain pale and fail to gain in weight in
spite of a liberal and well-balanced diet. Cases of this kind are not infrequent. In this
connection it is worthy of note that 4 of the 41 cases of “cœliac disease,” an interesting

intestinal condition described by Still, had scurvy just before or during the onset of the
disease. This observation conforms to the experience that chronic bowel disorders often
follow in the wake of adult scurvy.
In adults the heart may be weakened by scurvy, and death may result from cardiac failure.
Cardiac disturbances occur also in infantile scurvy. This involvement might be expected, in
view of the tachycardia (cardiorespiratory phenomenon) which is so frequent a symptom of
infantile scurvy. The heart may be rapid for months or even for years after the disorder, and
tachycardia may develop on the occasion of even a mild infectious disease. For example, a
fever of 101°, due to a common coryza, may cause the heart-beat to rise to perhaps 180 a
minute. Children so affected succumb readily to infection, especially to pneumonia, which
may lead to sudden collapse followed by death.
An important factor in the prognosis of scurvy, as in that of other disorders due to a lack of
vitamines, is the marked susceptibility to infection. Even latent or subacute scurvy causes a
peculiar susceptibility to diphtheria (especially the nasal type), to coryza, bronchitis, and
pneumonia. A perusal of the literature shows that this susceptibility was noted by the older
authors in relation to adults.
The local signs usually disappear quickly without leaving any trace. The hemorrhages are
absorbed and the eczema heals within a few days. The fractures unite promptly with the
formation of an unusually large callus. The urine, which may have contained red blood-cells
or have been markedly hemorrhagic, quickly becomes normal and, in our experience, gives
no further evidence of renal damage. Still reports, however, the case of a frail child who had
a trace of albumen in the urine two years after an attack of scurvy. A rare local injury, which
may lead to death, is cerebral hemorrhage. Recently Sammis reported a case of this kind,
which was characterized by convulsions during life, and in which subdural hemorrhage was
found at necropsy.
If we acknowledge an individual idiosyncrasy to scurvy we should expect a tendency to a
recurrence of the disease. Lind was of this opinion, stating that “by observations made on
this disease, it appears that those who are once afflicted with it, especially in so high a
degree as that squadron was, are more subject to it afterwards than others.” It is difficult at
the present day to express a personal opinion on this matter, as clinical experience is meagre
and the scurvy of guinea-pigs is so acute that it cannot be used for comparison. Some of the
recurrences have been due probably to the fact that the patient had not been completely
cured of his first attack. We have met with two cases of recurrences in infants, one of which
is of particular interest as it happened in spite of giving lemon juice in the intervening period.
The history was as follows:
In September, 1914, one month after the baby was admitted to the institution, it
developed scurvy of a moderate grade. It was then six months of age and weighed 10¼
pounds. It was put on a simple mixture containing from 24 to 30 ounces of pasteurized
milk and was given in addition ½ ounce of lemon juice a day. It improved, but during
the winter had bronchitis, otitis, enteritis, and later furunculosis. In spite of the fact that
it had been receiving an antiscorbutic for almost this entire period, it developed scurvy
once more in February, at the age of 11 months, and when it weighed 14½ pounds. It
was evident that this baby was peculiarly susceptible to scurvy. It may be added that the
second attack was complicated by nasal diphtheria.

In this connection attention should be drawn to a peculiar and puzzling clinical phenomenon,
which we have noted several times. Even if the antiscorbutic treatment is carried out
incompletely and only for a short period, recrudescences may not take place. We have seen
cases where orange juice was given for merely ten days or two weeks—that is, only until all
scorbutic signs had disappeared,—and yet the scurvy did not return, the infants thrived for
months thereafter, but were merely somewhat pale and undernourished. In the case of two
babies which we have in mind, the diet remained absolutely unchanged, with the exception
of the short period of antiscorbutic treatment, but this seemed sufficient to bring about a
diminished susceptibility.

CHAPTER IX
TREATMENT
“Seek the cure of scurvy neither in the armamentarium of the physician nor in the apothecary
shops. The druggist will be of as little aid to you as the art of the surgeon. On the other
hand, employ fresh vegetables, the juice of fresh antiscorbutic plants, oranges and lemons or
the juice of those fruits preserved with sugar; in this way without other means you will be
able to overcome this terrible disease.” This reads like the advice of some modern
therapeutist; it is, however, the conclusion of a physician (Kramer) who wrote on scurvy
almost two hundred years ago, and shows that the treatment of scurvy has undergone no
fundamental change in the intervening years. Our resources, however, have been amplified
by an increased knowledge of the relative value of antiscorbutic foodstuffs and by the
introduction of some new ones.
Prevention.—In the Temperate Zone, under ordinary conditions, the adult population
consumes sufficient antiscorbutic foodstuff to protect it from scurvy. Under exceptional
circumstances, however—for example, when the potato crop fails, or, in the case of
individuals, when the diet has been unduly restricted, scurvy will be encountered. This
disorder is still an important problem, however, in relation to the health of adults in the
Tropics, in military expeditions and in Polar explorations. From what has been stated in the
preceding chapter, it is evident that, at the present time, no reliance can be placed on
dehydrated vegetables as a protective agent. The recent suggestion of using germinated
dried pulses and seeds, under circumstances where fresh food is not available, is practical
and probably will be resorted to in the future. To this end the pulses (beans, peas, lentils) are
soaked in water for 24 hours, and then kept moist with access of air for about 48 hours at
room temperature. During this period they sprout and develop small radicles. They are
cooked in the usual way and have been found to possess an antiscorbutic value comparable
to that of most vegetables. An individual should receive about four ounces a day of these
sprouted seeds. In the treatment of some Serbian soldiers suffering from scurvy, Wiltshire
found that this amount of germinated beans brought about a cure. There are, however, two
drawbacks to their general use. The prolonged cooking necessary for their preparation
reduces their antiscorbutic potency, and they have been found indigestible when consumed in
sufficient quantity.
Under similar conditions canned tomatoes can be employed; they have the disadvantage of
greater bulk, but are a more potent antiscorbutic, require no preparation whatsoever, and are
readily digested. They form part of the present ration of the United States Army, in which
they can be given “in lieu of an equal quantity of potatoes not exceeding twenty per cent. of
the total issue.”
50
The necessity of including an antiscorbutic in the army ration has been
recognized only in recent years; during our Civil War and for thirty years thereafter there was
no such provision. It was stated at that time that a general scorbutic taint pervaded the
troops—a mere euphemism for the widespread existence of subacute or latent scurvy. Even
to-day the ration of the French and of the Italian armies makes no definite provision in this
regard and the Russians provide merely for a variable quantity of vegetables.

Recently it has been shown that lemon and orange juices (Givens and McClugage) can be
dried and still preserve their antiscorbutic value. It is quite possible that concentrated
preparations of this kind will be serviceable for army use and in regions where fresh fruit or
vegetables cannot be obtained.
51
Lind makes numerous ingenious suggestions for preparing antiscorbutic remedies (Lind, pp.
7, 8 and 9) which have a practical as well as historic interest. (Appendix 1.) One of these
includes a formula for the preparation of orange and lemon juice which may be preserved for
years; another gives a method for the preservation of berries and other fruits which are to be
picked when partly ripe and put up in earthen pots; still another gives the recipe for
preparing a simple decoction of fir tops, which was found by the Swedes efficacious in
preventing the development of scurvy among their soldiers. It is interesting that a similar
practice was resorted to in Vienna during the recent war and recommended as a prophylactic
for scurvy in children (Tobler).
The prevention of infantile scurvy, especially in its rudimentary form, is of great practical
importance, because of its frequent occurrence. There is no question but that breast milk and
raw cow’s milk furnish sufficient antiscorbutic vitamine, but there is a difference of opinion as
to whether pasteurized milk, or milk that has been brought just to the boiling-point, or even
sterilized milk, is adequate in this respect. Much of this divergence of opinion is due to the
fact that the various clinicians have not considered or stated the quantity of milk which they
have found sufficient to protect, and also because milk itself differs in its antiscorbutic value
according to its freshness and probably also according to the fodder of the cows.
52
Without
entering once more into a discussion of this question, it may be stated that unless the cow’s
milk is raw, the infant should receive additional antiscorbutic foodstuff. Moreover, this
supplement to the dietary should be made as soon as possible, so as not to allow the
vitamine deficiency and inadequate diet to exist for even a short period. In our experience
there is no contra-indication to the giving of orange juice or of strained canned tomato, the
two antiscorbutics with which we have had a large experience, to babies one month of age or
even younger. The common practice, however, is to wait until the infant is five or six months
of age, which certainly must allow a rudimentary scorbutic condition to develop. At the age of
a month one teaspoonful of orange juice may be given; it should be diluted with water and
sugar added if it is tart. This may be administered notwithstanding the fact that a baby has a
tendency to looseness of the bowels, as orange juice, as recently pointed out by
Gerstenberger, has practically no laxative action. Occasionally babies regurgitate orange juice,
but the reaction usually ceases after a day or two. If it does not, a small amount of an alkali
—for example, limewater or sodium bicarbonate—may be added just previous to feeding; in
this state the juice will be better tolerated.
53
The amount of orange juice should be increased
so that when the baby is three months of age it receives one tablespoonful.
A few years ago Hess and Fish recommended the use of an infusion of orange peel in infant
feeding. The peel was finely grated, soaked overnight in water (1 ounce of the peel to 2
ounces of water), and a small amount of sugar added to this liquid. Animal experiments
showed that this preparation possessed decided antiscorbutic value. This decoction may well
be used for the sake of economy, and even when the orange juice is employed the infusion of
the peel may be added.
An antiscorbutic which vies with orange or with lemon juice in adaptability for infant feeding
is canned tomatoes, as recently suggested by Hess and Unger. Tomatoes are not in good
repute among food experts in view of the small amount of calories which they contain—only

about 100 to the pound—and are regarded with suspicion amounting almost to superstition
by mothers and nurses as a food for children. In spite of this fact, it may be stated without
hesitation that they are fully as well borne by infants a few weeks or months of age as
orange or lemon juice. In considering antiscorbutics, it has been shown that notwithstanding
the canning process and subsequent aging, they preserve their potency. The dose is two
tablespoonfuls for babies over three months of age. The tomatoes are merely strained
through a colander and warmed (not cooked). To illustrate their innocuous character, it may
be added that as much as 6 and 8 ounces a day of this juice have been given to a baby
under one year of age without producing untoward symptoms. This antiscorbutic should have
wide applicability, especially in the United States.
54
Another antiscorbutic which can be used in a routine way to prevent infantile scurvy is swede
juice, prepared by grating the raw vegetable and squeezing the pulp in muslin. Chick and
Rhodes report that this juice has been adopted for use in some of the English infant-welfare
centres. It should be given in about the same dosage as the tomatoes, and seems applicable
where the swede can be readily obtained.
For babies over six months of age, reliance may be placed on the ordinary household
vegetables—potatoes, spinach, carrots, squash, etc. Attention should be paid to the amount
which is taken, as one or two teaspoonfuls of a vegetable which is poor in antiscorbutic
power, such as carrots or beets, will be insufficient to protect against scurvy. Especially is this
true if the vegetables are old and stale and are cooked for a long period;
55
some years ago
two infants under our care developed scurvy in spite of a small daily ration of vegetables.
Potato in the amounts usually consumed is a valuable antiscorbutic. It is not an exaggeration
to state that it is the main antiscorbutic bulwark of man. In giving baked potato to children it
is commonly advised to use the floury part just beneath the peel; this should be put through
a sieve and mixed thoroughly with boiled milk so as to constitute a cream; for younger babies
it can be prepared with water to form a diluent similar to the barley water so commonly
employed to dilute cow’s milk (1 tablespoonful of potato to a pint of milk, cooked for 15
minutes). Little reliance should be placed on beef juice in the usual dosage and none on
eggs.
Cure.—There is almost nothing in the realm of therapy which is so striking as a scorbutic
patient’s prompt reaction to antiscorbutic treatment. It is all the more marvelous as the cure
is effected by means of foodstuffs with which we are accustomed to associate no specific
virtue. A magic result is seen frequently within 24 or 48 hours. A baby which has had a poor
appetite, has been irritable and exquisitely tender, suddenly regains its appetite, is no longer
fretful, and can be handled without occasioning crying. Within a week, if the case is mild, all
definite symptoms of scurvy may have disappeared, and soon thereafter the infant is thriving
and apparently cured. A table is here reproduced (Table 6) from the report of the American
Pediatric Society showing the duration of treatment before marked improvement was noticed:
TABLE 6
Duration of TrÉatmÉnt BÉforÉ MarkÉÇ ImérovÉmÉnt was
NoticÉÇ
DaysCasesWeeksCasesMonthsCases
1 19 1 47 1 6
2 58 2 27 2 4
3 46 3 8 3 4

4 26 4 1
5 19 5 1
6 1 6 1
7 2
8 2
9 1
10 7
12 2
In most instances a gain of weight accompanies improvement. In not a few instances,
however, there is a temporary loss or cessation of weight, due in part to an increased
excretion of urine. Occasionally there is observed a short exacerbation of the symptoms
following the giving of an antiscorbutic—a swelling of the thigh or hemorrhage of the gums.
A similar phenomenon has been noted in relation to the treatment of polyneuritis in birds and
of beriberi in man.
In the cure of scurvy the same dietetic remedies are employed as in its prevention. Orange
juice is the sovereign remedy, and should be given in a dosage of about 2 ounces a day.
56
Canned tomato is also most efficacious. If these changes in the dietary are carried out, it is
not absolutely necessary to alter the food, although it is advisable to do so. Some writers, for
example Neumann and Czerny, treat the disorder by giving milk which has been scalded or
brought to the boiling-point. Others lay particular stress on changing the source of the milk
supply, believing that the sameness of the diet leads to the occurrence of scurvy. Such,
however, cannot be the case, as otherwise breast-fed babies would be highly subject to this
disease. In the report of the American Pediatric Society one case developed on condensed
milk and was cured by sterilized milk, and another developed on pasteurized milk and was
cured by sterilized milk and broths. These results are explicable; large amounts of milk were
given to effect the cure. It may be said in general that in addition to giving fruit or vegetable
juices the milk should be either raw or heated to as low a degree as possible (duration of
heating as well as height of temperature). Furthermore, the antiscorbutic treatment should
be continued for a period of months, as the clinical improvement far outstrips the restoration
of the bones and other tissues. It seems necessary again to call attention to the fact that too
great reliance has been placed on the use of beef juice, which has been shown, both in
experiment and in the clinic, to possess comparatively weak antiscorbutic properties.
Orange juice may be given intravenously. This method may be resorted to where the patient
is in an advanced stage of the disease or where food cannot be tolerated by mouth; for
example, in cases such as that mentioned by Cheadle, where death took place owing to the
fact that the antiscorbutic could be taken only sparingly, on account of the extreme
prostration of the patient. For this purpose the orange juice is obtained in as sterile a manner
as possible, boiled for about five minutes and is rendered neutral or slightly alkaline just
previous to its injection by the addition of normal sodium hydroxide. Hess and Unger report
three cases where this procedure was carried out without the slightest untoward reaction. In
one instance, improvement was noted 16 hours after the injection. In view of the novelty of
this treatment it may be of interest to cite a case:
A baby 16 months old had hemorrhage of the gums and tenderness of the legs, which
were held in the characteristic flexed and everted position. Eliminative treatment was
tried without avail; Dover’s powder and warmth to promote perspiration; caffeine to

promote diuresis; and 2 tablespoonfuls of liquid petrolatum three times a day to increase
elimination from the bowels. Intravenous injections of salt solution also proved of no
value.
Four intravenous injections of orange juice were given—6 c.c., 12 c.c., 6 c.c., and 35 c.c.
As was stated, improvement was noted 16 hours after the first injection. The infant was
less irritable, the gums no longer hemorrhagic, and the “capillary resistance test” (that is
to say, the development of petechial spots on the forearm when a tourniquet was
applied for 3 minutes to the upper arm) changed from positive to negative.
Harden, Zilva and Still have recommended the use of a concentrated lemon juice for the cure
of scurvy, constituting a form of “intensive” treatment. In four cases this proved to be of
clinical value. Freise has made use of an alcoholic extract of turnips, and Freudenberg of a
similar extract of carrots. These preparations did not seem to be markedly potent, and
therefore possess no particular therapeutic advantages.
Non-dietetic Therapy.—There is little to be done for the patient in addition to the giving of
sufficient antiscorbutic. No one has reported success with any drug. We have tried the use of
atropin, adrenalin, thyroid and parathyroid extracts, cod liver oil, autolyzed yeast, lactose,
sodium chloride, calcium chloride, etc., without noting any improvement. Mercurials are
stated to be positively harmful, especially when ulcers are present. The patient should be
kept in bed, and exertion not allowed on account of the involvement of the heart, which has
led to sudden collapse and death. The gums may be treated with nitrate of silver stick or
tincture of myrrh. If there is fracture of the long bones with displacement, splints should be
applied. Under no circumstances should hemorrhagic effusions in or about the joints be
incised. The patient should be placed in a room which is well aired and lighted, and should be
handled and dressed as infrequently as possible, so as to avoid discomfort and pain. It is
particularly important that intercurrent infections should be avoided by shielding patients
from contact with those who have infectious diseases, especially respiratory infections.

CHAPTER X
METABOLISM
Studies of the chemical exchanges in scurvy have been surprisingly few. It is a field that
should repay investigation, promising to afford a clearer insight into the intermediary
metabolism in this disorder. One of the first to touch upon this question was Garrod, who in
1848 reported that there was a diminution of potassium salts in the urine and in the blood of
scurvy patients. In 1877 Ralfe confirmed the potassium deficiency in the urine, but denied its
importance from an etiologic standpoint, as he was unable to benefit scurvy patients by
administering potassium nitrate. He reported an increase of uric acid in the urine, a
diminution of the total acidity, and a reduction of the alkaline phosphates. Litten found the
analyses of the urine very contradictory in respect to potassium, but stated that beyond a
doubt its uric acid content is increased at the height of the disease, although this diminishes
rapidly with convalescence. These few and scattered articles comprise the sum of metabolic
studies up to the last decade, and even during the succeeding period they have been very
few—so few, indeed, that they furnish insufficient data from which to draw conclusions.
The first careful study of the mineral metabolism in a case of scurvy is that of Baumann and
Howard, published in 1912. Its conclusions are not very definite. They may be summed up by
their statement that “chlorin and sodium were retained during the fruit-juice period, but
excreted in excess of the intake during the preliminary period,” and that “more potassium,
calcium and magnesium were retained during the fruit-juice period.”
This same year Lust and Klocman published the first metabolism study of a case of infantile
scurvy. The baby was 18 months old and the metabolic changes were investigated during the
active, convalescent, and “the healing stage” of the disorder. This study seems to have been
carefully carried out. The fact, however, that the infant received 800 c.c. daily of slightly-
boiled milk during the active stage, and was improving at this time, may also have had a
beneficial effect on the metabolism in respect to scurvy. The results of these writers are
surprising—quite different from what they expected or what we should have expected. They
write: “The balance of the mineral metabolism, including the total ash, the calcium,
phosphorus and chlorin during the florid stage of the disease must be regarded not only as
not damaged, compared to that of the healthy child, but indeed as somewhat increased.” “All
the more striking, on the contrary, are the results found during the stage of convalescence.
Here the balances were all markedly negative, and only after a lapse of weeks was the
tendency manifested to a return to normal conditions.” The authors regard these results as
indicating a sort of washing out of “dead material” during convalescence—of material which
had gathered during the florid stage of the disease. According to their interpretation the
disease is due, not to a primary or secondary salt deficiency, but to a disturbance in salt
elimination, and in the first place, of a calcium excretion. This is shown by the fact that even
in the “stage of healing,” when the total ash and the phosphorus balance once more had
become positive, the calcium balance nevertheless remained somewhat negative. The
metabolism of infantile scurvy, they believe, far from showing a resemblance to rickets,
manifests quite the contrary tendency. The study of this case of infantile scurvy and that of

Baumann and Howard of a case of adult scurvy, comprise the total investigation of the
metabolism in human scurvy.
In the course of a recent discussion on rickets before the Medical Society of Vienna, Moll
states briefly that in a case of infantile scurvy, at the height of the disease, he found a
positive calcium balance, which became poor and later negative on giving fruit juice; in other
words, a partial confirmation of the work which has just been cited.
In 1913 Bahrdt and Edelstein reported the analyses of the organs of an infant almost nine
months old who died of scurvy; an examination of the tissues, especially of the bones, should
be most valuable in checking up determinations of the metabolism during life. This
investigation runs absolutely contrary to that of Lust and Klocman. The bones showed a
decrease of ash, especially of calcium and of phosphorus, and also a lack of calcium in the
muscles, but normal amounts in the liver and in the kidneys. These conditions resemble the
deficiency of ash and of lime commonly associated with rickets, and it seems quite possible
that this infant had rickets as well as scurvy, and that in this way the discrepancy between
the two reports is to be explained. The fact that the water content of the bones was two to
three times the normal, also lends emphasis to this interpretation. In any metabolism study
of infantile scurvy, great care will have to be exercised that the disorder is not complicated by
rickets, and the issue thereby confused. It will be very difficult to avoid this pitfall, for there is
no test by which early rickets can be diagnosed. The danger of this complication may be
realized when we bear in mind that the majority of infants have rickets to some degree. An
investigation of the chemistry of adult scurvy has an advantage from this point of view.
Chemical examination of the blood has yielded such valuable information regarding metabolic
diseases, that it might be expected to shed light on the disturbances of scurvy. The only
investigation from this standpoint is that of Hess and Killian, who have reported estimations
of the urea, creatinine, sugar, CO
2
combining power, diastase, cholesterol, chlorine and
calcium.
57
The urea content was normal, varying between 12 and 14 mg. per 100 c.c. of
blood; this is the average of twenty-one tests on ten cases of infantile scurvy. (In severe
cases of beriberi Yano and Nemoti have recently reported that the blood contains an increase
of urea, and that its excretion is frequently disturbed.) The creatinine was estimated in two
cases and was found to be 2.0 mg. and 1.7 mg. per cent., respectively,—also normal figures.
The blood sugar varied from 0.12 to 0.14 per cent. and was examined in almost all the cases
in which urea was estimated; these figures are at the upper level of normality (no attention
was paid to the interval elapsing between the feeding and the withdrawal of the blood). The
diastatic activity was likewise normal. The CO
2
combining power showed figures under 40 to
45, according to the Van Slyke method, and indicated therefore a mild degree of acidosis. In
six cases the chlorides were estimated, the figures being remarkably constant at about 0.42
or 0.43. Cholesterol was a little below normal in the four cases examined. Contradictory
results were obtained in regard to calcium. Earlier tests showed a definite deficiency of this
salt, but those carried out more recently have generally yielded normal results. Further
studies of the blood calcium are highly desirable to ascertain whether it varies in amount in
the circulation, and especially in different stages of the disease. This aspect is worthy of
particular attention in view of the positive calcium balance noted by Lust and Klocman during
the active stage of scurvy, and the negative balance during the period of convalescence.
It is evident from the limited data concerning the blood chemistry of scurvy that it is a field
which has been inadequately explored and will repay more intensive study. Investigations of

this kind have recently been made possible by the introduction of accurate methods requiring
only small quantities of blood.
Studies of the metabolism of animals suffering from scurvy are almost as few as those on
man. The work of Morgan and Beger, which is frequently quoted in this connection, is not
applicable, as it concerns rabbits, which do not develop scurvy. They found that rabbits fed
solely on oats and water suffered in their nutrition (loss of appetite, emaciation, paralysis of
hind legs), and could be cured by the addition of sodium bicarbonate to the dietary. In 1916
Lewis and Karr published a paper on the constituents of the blood and the tissues of guinea-
pigs fed on an exclusive oat diet. They found the urea content several times greater than
normal, but that it fell to normal once more if cabbage or orange juice was given. From the
standpoint of scurvy, this investigation is open to the criticism that the diet was too
incomplete, and also, as the authors suggest, that the animals suffered from partial
starvation and a lack of water.
In the following year Karr and Lewis published a paper on a different phase of this subject,
and came to the following conclusions: “No changes in urinary elimination of phenols, nor in
the degree of conjugation of the phenols, were observed, provided the factor of partial
starvation was ruled out. This is believed to indicate that no increased bacterial action occurs
in the intestine of scorbutic guinea-pigs despite the difficulty of evacuation of the fæces.”
These results are in harmony with the bacteriological study of Torrey and Hess, who found
that there was no increase in the proteolytic flora of the intestine in infants or in guinea-pigs
suffering from scurvy.
In 1917 Baumann and Howard published the only metabolism study which has been carried
out on guinea-pigs suffering from scurvy, and they are of the opinion that this disorder has a
profound effect on the mineral metabolism of this animal. The calcium was excreted in
notably large amount; potassium was also lost, and to a greater extent than sodium; the only
element which was consistently retained during the active stage as well as during the period
of recovery, was magnesium. This study was followed shortly by one from the same
laboratory, by Howard and Ingvaldsen, carried out on a monkey suffering from scurvy. It was
inconclusive, not conforming to the experiments on the guinea-pigs; the authors state that
the “changes in the mineral excretion of the monkey during the scorbutic period were not
sufficiently significant to admit of easy interpretation.” “The marked loss of the various
mineral substances encountered in experiments with man and guinea-pig was not observed
in the present series.” It should be remembered, however, that the diets of the guinea-pigs
and the monkeys were quite different, the former consisting mainly of oats, and the latter of
condensed milk. It is quite possible that the basic diet may play a rôle in the metabolism of
this disease, although, as stated elsewhere, its effect cannot be noted clinically. Special
attention should be paid to this factor in metabolic studies, in view of the widely-held opinion
that the carbohydrates exert a potent influence in the development of beriberi.
The investigations of the nitrogen metabolism in man and in animals have been most
unsatisfactory. The two on human beings—an infant and an adult—were negative; that on
guinea-pig scurvy cannot be utilized on account of the restricted diet of oats, which contained
insufficient nitrogen, whereas the one on the monkey showed some loss of nitrogen, which
led the authors to suggest an increased nitrogenous catabolism in scurvy. This comprises the
total data on this subject.
Summarizing the results of these few metabolic studies, it may be stated that they harmonize
on one point only—the positive balance of calcium during the active stage of the disease. The

investigation of Baumann and Howard on adult scurvy, of Lust and Klocman and of Moll on
infantile scurvy, and of Howard and Ingvaldsen on the monkey, are all in agreement in this
important conclusion.

CHAPTER XI
RELATION OF SCURVY TO OTHER DISEASES
In the foregoing there has been frequent reference to the close relationship between scurvy
and the incidence of the infectious diseases—to the fact that a scorbutic condition increases
the susceptibility to infection. This is indeed one of the most characteristic, as well as one of
the most important phenomena associated with scurvy and other disorders resulting from
vitamine deficiency. Mention has been made of the special susceptibility to the diphtheria
bacillus, and to the organisms leading to coryza and the respiratory diseases, but no doubt
this applies also to invasion by other bacteria. We wish, however, to confine ourselves to the
nutritional disorders, first in their relationship one to the other, and second, as a group of
deficiency diseases, due to a lack of vitamines of various kinds. As is well known, in addition
to scurvy, this group generally includes beriberi, a disease attributed to a lack of the water-
soluble vitamine, and xerophthalmia, an eye condition which recently has been brought about
in rats by placing them on a diet free from fat-soluble vitamine. These, however, form only
the nucleus of the disorders which commonly are included in this category. Schaumann, the
first to formulate this classification, illustrated his conception of the interrelationship by
depicting the various members as spokes of a wheel surrounding a central hub. He included
scurvy, rickets, osteomalacia, typical beriberi, ship-beriberi, pellagra and mehlnaerschaden.
Funk made a similar classification of disorders which he termed the “avitaminosen.” There is
a tendency to enlarge rather than to decrease the membership of this class, and recently war
or hunger edema, infantile atrophy and diarrhœa, sprue, cœliac disease, leprosy and others
have been proposed as suitable candidates. At the present time it is impossible to determine
which and how many of this motley company should be associated with scurvy. Some,
possibly, are the result of a lack of vitamine, but for the present it will be well to bear in mind
that three vitamines only have stood the test of experiment, and only these three therefore
can be definitely connected in a causal relationship with pathologic conditions. In addition to
this consideration of the interrelationship of the “deficiency diseases,” the kinship of allied
disorders—more particularly of rickets—must be discussed.
Although at first thought beriberi and scurvy would seem far apart from a clinical point of
view, they have some important features in common. In both there is a tendency to a
rapidity of the heart’s action and a marked lability of the pulse, to an enlargement of the
cardiac ventricles, to an involvement of the vagus, and to an exaggeration of the deep
reflexes. It is unnecessary to describe these signs and symptoms in detail, as they have been
fully considered under symptomatology. It has been recorded from time to time that under
certain circumstances scurvy has developed in man where one should have expected beriberi,
and vice versa. Darling, who has had a large experience in this field, writes: “A deficient
dietary in a tropical African negro mine laborer causes severe scurvy, in a Cape Colony
African mine laborer, mild scurvy, and in some African negroes a diet that causes scurvy in
one set of men causes neuritis in others.” Possibly some minor differences in the dietary can
explain this difference in reaction—for we do not know all the sources of the water-soluble
vitamine, but such an experience deserves to be cited as it is not an isolated instance. It is all
the more worthy of attention because it harmonizes to a certain extent with the everyday
experience of animal investigation. As has been stated elsewhere, a diet of decorticated grain

will lead to scurvy in the guinea-pig, to polyneuritis in the pigeon, and to a combination of
these diseases in the hog! Results of this kind show that there must be a relationship
between the etiologic factors of scurvy and of beriberi. It is unwise at present to attempt to
define the relationship more precisely. The remarkable observation, first made by Fuerst, and
since confirmed by numerous investigators, that seeds and legumes are devoid of
antiscorbutic potency but acquire this power on sprouting, constitutes another link in the
evidence of their kinship. Funk has suggested that the antiscorbutic vitamine can be formed
from the “antineuritic” vitamine, a theory which is very attractive but needs confirmation and
experimental proof. It is quite evident that this change does not usually occur in animals, in
view of the specificity of the vitamines for their respective diseases—of the antiscorbutic for
scurvy and the water-soluble for beriberi.
It will be noted that “ship-beriberi” is included in this group of diseases. Very little is known
about this condition, except what is contained in the investigation of Nocht (1903) and that
of Holst and Froelich. It is a very rare condition but of interest because it is characterized by
spongy, hemorrhagic gums and other signs encountered in scurvy. The feature which
differentiates it sharply from scurvy, however, is an anæsthesia of the extremities. Ship-
beriberi is generally regarded as a combination of beriberi and scurvy. Where these two
disorders occur concomitantly, the beriberi manifests itself some months before the scurvy, as
the latter takes much longer to develop.
In considering the vitamines in connection with diseases of the nervous system, mention may
be made of “central neuritis” and the “peripheral neuritis” which has been reported from the
West Indies. This bears only a partial resemblance to beriberi, as there is no edema, nor
dyspnœa, and its course is more chronic. Judging from the report of Edwards from Jamaica,
the cases more closely resemble pellagra, terminating after many years. A degeneration of
the cells of the spinal cord was found and “in some isolated patches of the cerebellum and in
the roots of the optic and auditory nerves.” The disease occurs among the poor classes
whose diet is inadequate chiefly in nitrogen.
Eijkman was the first to draw an analogy between beriberi and pellagra, and thus to suggest
that the latter might be a disease due to an unidentified factor; he compared the pernicious
effect of a diet of polished rice with that of decorticated corn. Of recent years, largely as the
result of the investigations of Goldberger and his co-workers, pellagra has come to be
regarded as a dietetic disorder primarily due to a lack of adequate protein, rather than to a
lack of a specific vitamine. Its relationship to scurvy cannot, therefore, at the present time,
be discussed from an etiologic viewpoint. Apart, however, from the question of etiology, the
two diseases have certain clinical symptoms in common. Weston states that “distinguished
physicians, who were really astute observers, have mistaken pellagra for scurvy, eczema,
various kinds of intestinal troubles, syphilis, and many other diseases.” In the chapter on
symptomatology, attention has been directed to the fact that an eczema which yields to
antiscorbutic treatment may occur in scurvy; at times it presents the symmetrical
arrangement so typical of pellagra. In other cases a fleeting erythema may be observed,
another sign noted frequently in pellagrins. In some instances congestion of the gums has
been recorded. In describing a little girl of three who had pellagra, Weston writes: “The gums
are also red and swollen, suggesting scurvy.” This child had eaten large amounts of turnips,
so that there could have been no question of complicating scurvy. Lombroso and some of the
earlier authors drew attention to the fact that fragility of the bones, of the ribs and of the
long bones, was often associated with pellagra. These various clinical similarities should not
be construed as evidence in favor of the “avitamine” nature of pellagra. They indicate, rather,

that in nutritional disorders, whatever may be their underlying cause, the vessels, the bones,
and other tissues may suffer and lead to similar—but not identical—clinical pictures.
58
The relation between scurvy and rickets is a subject which was discussed by Glisson. With
the renewed interest in infantile scurvy which followed Barlow’s work toward the end of the
last century, children’s specialists ranged themselves into opposing camps on the question of
the interrelationship and interdependency of these two diseases. Some accepted Barlow’s
dictum that infantile scurvy is an absolutely distinct and separate entity; others, for example,
Hirschsprung, declared that the so-called scurvy was merely a form of rickets; whereas a
third group considered it a combination of rickets and scurvy. This last viewpoint was actively
maintained by Cheadle on the clinical side, and later by Schoedel and Nauwerk on the
pathologic side—the latter declaring that rickets is “an inseparable component of infantile
scurvy,” and that the entire disease should be regarded merely as “an episode in the course
of rickets.” Even Barlow, in a paper published in 1894, wrote: “Rhachitic changes already
present may act as a physiological determinant of the sites in which scurvy becomes
manifest” and “rickets as a basis plus inadequate food gives the simplest explanation of the
typical case” (of scurvy).
We had an exceptional opportunity to test this thesis in 1914, in an institution where scurvy
broke out among infants who were on a diet of pasteurized milk. All these infants were
receiving cod liver oil daily, as prophylactic treatment against rickets. Many infants have been
seen since that time, who in spite of receiving cod liver oil developed scurvy, and others in
whom large doses of this oil failed to mitigate the scurvy, although it prevented rickets. The
same failure has been encountered in the treatment of scurvy in guinea-pigs. This experience
has been without exception, both from a prophylactic and a curative standpoint.
Confusion between the two diseases has resulted from the fact that the majority of infants in
the Temperate Zone have some degree of rickets. Thus the two diseases have been found
very frequently associated in pathologic examination of the bones, leading some to infer that
they are in some way interdependent. They have been also confused clinically, as mentioned
in another connection, owing to the fact that beading of the ribs—the rhachitic rosary—has
been mistakenly regarded as a pathognomonic sign of rickets, whereas it is also a sign
common to scurvy. It is important to bear in mind that from the pathologic viewpoint scurvy
and rickets present strikingly dissimilar pictures—the former is characterized by an almost
complete cessation of activity of bone-forming elements, whereas the latter is distinguished
by a hyperplastic condition leading to a marked overgrowth of cartilage and of abnormal
bone. Viewed from the pathologic, etiologic and clinical standpoint, we believe that there is
no basis for assuming an interrelationship between the two disorders, and that scurvy will
develop as readily and as rapidly where rickets is absent as where it is present.
59
It is premature to discuss the relationship of these two disorders from the vitamine
standpoint. In 1910 Schaumann suggested that rickets was due to a lack of a specific food
factor, and somewhat later Funk included it among the “avitaminosen.” Recently Mellanby, as
the result of experiments on dogs, has affirmed that the fault lies in a lack of the fat-soluble
or a closely-related vitamine. Investigations of the near future will probably decide the merits
of this contention; our experience is that rickets develops in infants even where the diet
contains adequate fat-soluble vitamine. If rickets is proved to be a disorder depending on a
vitamine, it belongs, naturally, in the same group as scurvy. This would indicate relationship,
but not interrelationship. Just as the mere fact that a lack of vitamines leads to scurvy and to
beriberi does not signify, in theory or in practice, the existence of pathogenetic

interrelationship. However, as stated, this is a subject which does not as yet rest on a secure
foundation.
Osteogenesis imperfecta and osteomalacia are disorders of dietetic or metabolic origin
characterized by fragility of the bones. The latter has developed new significance and
importance due to its increased occurrence in almost epidemic form in the Central Empires at
the close of the World War. The etiology of both disorders is most obscure. In the future in
considering their pathogenesis it will be well to draw a sharp distinction between them.
Osteogenesis imperfecta is a disease in which an injury occurs to the fœtus without any
manifest illness in the mother, which seems to indicate a primary lesion of the fœtus
(perhaps metabolic); osteomalacia, on the other hand, attacks the mother who gives birth to
an apparently healthy fœtus. The latter gains added interest because it is a disease of the
bones which is attributed to dysfunction of the endocrine glands, to a disturbance especially
of the parathyroid. If this observation is confirmed, it furnishes another anatomical basis for
associating the glands of internal secretion with pathologic conditions of the bones.
One cannot survey the various diseases of the bones—scurvy, rickets, osteoporosis,
osteogenesis imperfecta, osteomalacia, etc.,—without realizing that this group is at present in
a state of great confusion and will have to be rearranged and winnowed. The differentiation
between some of these diseases is not in every instance clear morphologically—for instance,
early cases of scurvy and osteoporosis—so that it is difficult to consider them satisfactorily
from the standpoint of pathogenesis. Clinical differentiation is still more difficult and
uncertain. It seems probable that new entities will be established, as has happened in the
past. It is not so long since rickets included almost all the bone diseases of infants. Gradually
congenital syphilis, scurvy, and achondroplasia were segregated as distinct diseases. Probably
a similar separation of other pathologic conditions, now so entangled as to be
indistinguishable, will be evolved.
Among the diseases which have been attributed to a vitamine deficiency are “war or hunger
edema,” sprue, the “mehlnaerschaden” of infants, and the “exudative diathesis” described by
Czerny and Keller. Future investigation will disclose whether any of these disorders belong in
the group with scurvy. The hunger edema, noted in the late war and in previous wars, seems
to be a complex condition, quite dissociated from scurvy, as many of the sufferers consumed
comparatively large quantities of potatoes or other vegetables. The “mehlnaerschaden”
resembles scurvy and the other vitamine disorders in its tendency to produce hydremia and
susceptibility to infection. It also develops in spite of a liberal supply of antiscorbutic foodstuff
in the dietary. As its name implies, it comes about on a diet containing large quantities of
carbohydrate, of the cereal paps so commonly fed to infants. It is conceivable that an
unbalanced diet of this kind may not provide a sufficiency of all the vitamines.
It does not seem probable that exudative diathesis, a term which implies a predisposition to
develop exudations or denudations of the skin and mucous membranes, is the result of a lack
of vitamine. This condition does, however, predispose to scurvy. The association was very
evident in the group of cases reported by Hess and Fish in 1914. It is not without significance
that the blood-vessels in exudative diathesis also show a decided weakness, an increased
permeability, as judged by the “capillary resistance test.” In both scurvy and in exudative
diathesis eczema and petechial hemorrhages are encountered.
There may be nutritional diseases due to an excess of food rather than to a deficiency. A
superfluity may be harmful by hindering the proper utilization of the food, or may possibly
lead to the formation of deleterious products. Disturbances of this kind do occur. For

example, it is by no means uncommon for an infant which has been overfed with milk to
show the typical signs of rickets. Young guinea-pigs which are fed liberal amounts of cow’s
milk develop a disease characterized by fragility of the bones. The experience of Lubarsch,
who produced osteogenesis imperfecta in rabbits by means of a diet consisting mainly of
liver, or adrenal gland, is of interest, especially as this condition did not come about when
they were fed muscle tissue.
From what has been stated, it must be evident that this subject not only is in a state of flux
but that it is in a state of great confusion. This applies not only to the relationship of
vitamines to these disorders, but to their identification and demarcation pathologically as well
as clinically. During the past few years we have begun to regard these diseases from a new
viewpoint, which no doubt will be helpful, but it is probable that they will not be sharply
defined and their relationships determined until it is possible to bring about each disease
definitely and regularly in an experimental animal. Until this time we should proceed slowly,
and not bring about “confusion worse confounded” by yielding to the vogue, and grouping
together heterogeneous and little-understood clinical conditions under the caption of
deficiency diseases. There is a growing danger of attributing every unexplained nutritional
disorder to the new, overworked, but ill-defined vitamines—of their sharing with the
secretions of the endocrine glands the fate of becoming the dumping-ground for every
unidentified disorder.

APPENDIX
Extract from “Treatise on Scurvy,” by James Lind, London, 1772.
(a) Recipe for preparing a stable orange or lemon juice. Let the squeezed juice of these fruits
be well cleared from the pulp and purified by standing for some time; then poured off from
the gross sediment; or, to have it still purer, it may be filtrated. Let it then be put into any
clean open vessel of china or stone-ware, which should be wider at the top than bottom, so
that there may be the largest surface above to favor the evaporation. For this purpose a
china basin or punch-bowl is proper, and generally made in the form required; all earthen
glazed vessels are unfit, as their glazing will be dissolved by the acid. Into this pour the
purified juice, and put it into a pan of water, upon a clear fire. Let the water come almost to a
boil, and continue nearly in that state (with the basin containing the juice in the middle of it)
until the juice is found to be of the consistence of a thick syrup when cold. The slower the
evaporation of the juice the better; and it will require at least twelve or fourteen hours
continuance in the bath heat before it is reduced to a proper consistence.
It is then, when cold, to be corked up in a bottle for use. Two dozen good oranges, weighing
five pounds four ounces, will yield one pound nine ounces and a half of pure juice; and when
evaporated, there will remain about five ounces of rob, or extract; which in bulk will be equal
to less than three ounces of water. So that thus the acid, and the virtues of twelve dozen
lemons or oranges, may be put into a quart bottle, and preserved for several years.
I have now some extract of lemons which was made four years ago.
Those who intend this extract for making punch may infuse some of the fresh peel of the
oranges or lemons into the spirit before it is used.
But for this purpose I find it is sufficient to add a very small quantity of the outer peel to the
extract a little before it is taken off the fire, and there will be all that is requisite to make it
entirely equal to the freshest fruit.
(b) How to preserve berries and other fruits for long periods. And it may be proper to
acquaint them that most berries, and several fruits, when gathered two-thirds ripe on a dry
day, while the sun shines, if put into earthen pots, or rather in dry bottles, well corked, and
sealed up, so that no air or moisture can enter, will keep a long time, and at the end of a
year, be as fresh as when new pulled.
(c) Method of preparing an antiscorbutic decoction from fir-tops, leaves, bark, etc. When the
Swedes carried on a war against the Muscovites, almost all the soldiers of their army were
destroyed by the scurvy, having putrid gums, rigid tendons, etc. But a stop was put to the
progress of this disease by the advice of Erbenius, the King’s physician, with a simple
decoction of fir-tops, by which the most deplorable cases were perfectly recovered, and the
rest of the soldiers prevented from falling into it.
I am inclined to believe by the description given by Cartier of the ameda tree, with a
decoction of the bark and leaves of which his men were so speedily recovered, that it was
the large swampy American spruce tree.

A simple decoction of the tops, cones, leaves or even green bark and wood of these trees is
an excellent antiscorbutic medicine; but it will, I am apt to think, become much more so
when fermented, as in making spruce beer. By carrying a few bags of spruce or its extract to
sea, this wholesome drink may be prepared at any time. But where it cannot be had the
common fir-tops used for fuel in the ship should be first boiled in water, and the decoction
afterwards fermented with molasses in the common method of making spruce beer; to which
a small quantity of wormwood and horse-radish root (which it is easy to preserve fresh at
sea) may be added. The juice of the cocoanut tree was experienced to be of very great
benefit to several persons afflicted with the scurvy.

BIBLIOGRAPHY
AäbÉrt, J.: A Case of Infantile Beriberi with Autopsy Report, Phillip. Jour. of Sci., Sec. B, 1908,
III, 345.
AmÉrican PÉÇiatric SociÉty: Collective Investigation on Infantile Scurvy in North America, Arch.
of Ped., 1898, XV, 481.
AnÇrÉws , V. L.: Infantile Beriberi, Phillip. Jour. of Sci., 1912, VII, 67.
Anson, Lord: Walter and Robins, Voyage Round the World, London, 1848.
ArnÉth: Ueber Skorbut im Felde, Deutsch med. Woch., 1918, XLIV, 509.
Aron, H.: Biochemie des Wachstums des Menschen and die hoeheren Tiere, Jena, 1913,
Gustav Fischer, 58.
Aschoff , L., and Koch, W.: Der Skorbut, Jena, 1919, Gustav Fischer.
AussÉt, E.: (1) La Maladie de Barlow, Annal. de med. et chir. Inf., 1904, VIII, 289.
AussÉt, E.: (2) Un cas de maladie de Barlow chez un enfant nourri exclusivement avec du
babeurre frais, Bull. Méd., 1910, XXIV, 675.
Bachstrom : Observationes circa Scorbutum, 1734.
Baginsky , A.: Demonstration von anatomischen Praeparaten eines Falles von Barlowscher
Krankheit, Berl. klin. Woch., 1897, XXXIV, 324.
BahrÇt, H., and EÇÉästÉin , F.: Organanalysen bei Barlowscher Krankheit, Zeitschr. f.
Kinderheilk., 1913, IX, 415.
Baräow, T.: (1) On Cases described as Acute Rickets, Med. Chir. Trans., 1883, LXVI, 159.
Baräow, T.: (2) Infantile Scurvy and Its Relation to Rickets, Lancet, London, 1894, II, 1075.
BarnÉs, K. E., and HumÉ, E. M.: Relative Antiscorbutic Value of Fresh, Dried and Heated Cow’s
Milk, Biochem. Jour., 1919, XIII, 306.
Barrow , Sir Jay: Supplement to Encyclopedia Britannica, article “Navy,” cited by Budd.
BartÉnstÉin , L.: Beitraege z. Frage des kuenstlichen Morbus Barlow bei Tieren, Jahrb. f.
Kinderheilk., 1905, LXI, 6.
BatÉman: Scurvy in a Child, Birmingham Med. Review, 1886, Abstr. Arch. Ped., 1886, III, 304.
Baumann , L., and HowarÇ, C. P.: (1) Metabolism of Scurvy in an Adult, Arch. Int. Med., 1912,
IX, 665.
Baumann , L., and HowarÇ, C. P.: (2) Mineral Metabolism of Experimental Scurvy of the Guinea-
pig, Am. Jour. Med. Sci., 1917, CLIII, 650.
BÉnoit, A.: Une Épidémie de Scorbut, Paris Méd., 1919, IX, 469.
BÉrnhÉim -KarrÉr: Saeuglingskorbut bei Ernaehrung mit Homogenisierter Berner Alpenmilch,
Korrespondenzbl. f. Schweizer Aerzte, 1907, XXXVII, 593.

BäanÉ, Sir GiäbÉrt: Observations on the Diseases Incident to Seamen, 1789, London, J.
Murray.
BoÉrhaavÉ: Cited by Lind.
BoÉrich , R.: Ueber Skorbut, Archiv. f. Klin. Med., 1919, CXXX, 151.
Bohn: Acute Rachitis, Jahrb. f. Kinderheilk., 1868, II, 201.
BoäÇyrÉff, W. N.: Quelques Considerations sur les Causes étiologiques du Scorbut, Comp.
rend. soc. de biol., 1917, LXXX, 911.
BoääÉ, C.: Zur Therapie der Barlowschen Krankheit, Ztschr. f. diaetet. u. physik. Therap.,
1902–03, VI, 354.
BraÇÇÉn , W. L., and CooéÉr, E. A.: The Influence of the Total Fuel Value of a Dietary upon the
Quantity of Vitamine Required to Prevent Beriberi, Brit. Med. Jour., 1914, I, 1348.
BranÇt, H.: Blutuntersuchungen bei Barlow’scher Krankheit, Archiv. f. Kinderheilk., 1919,
LXVII, 395.
BuÇÇ, G.: Tweedies’ System of Pract. Med., Phila., 1841, Lea and Blanchard, 99.
BuÇin, P.: The Nursling, London, 1907, Caxton Pub. Co.
BurgÉ, W. E., and NÉiää, A. J.: (1) The Effect of Starvation on the Catalase Content of the
Tissues, Am. Jour. Phys, 1917, XLIII, 58.
BurgÉ, W. E., and NÉiää, A. J.: (2) The Normal Mechanism for the Control of Oxidation in the
Body, Am. Jour. Phys., 1918, XLVI, 117.
Busk, G.: Report of Committee on Scurvy, etc., London, 1877.
Caiääé, A.: Minority Report, Amer. Ped. Soc. Collective Investigation (see above).
CarÉä: Un Cas de Scorbut imputable au Lait Stérilisé, Bull. de la Soc. de Pédiat. de Paris,
1910, XII, 79.
CassÉä: Ein Fall von Skorbut, Arch. f. Kinderheilk., 1893, XV, 350.
CharéÉntiÉr , P.: Étude sur le Scorbut, Paris, 1871, A. Delahaye.
ChÉaÇäÉ , W. B.: Infantile Scurvy, Allbutt’s System of Med., 1901, V, 64.
Chick, H., and DÉäf, E. M.: The Antiscorbutic Value of Dry and Germinated Seeds, Biochem.
Jour., 1919, XIII, 199.
Chick, H., and HumÉ, M.: The Distribution Among Foodstuffs (especially those suitable for the
rationing of armies) of the Substances required for the Prevention of (a) Beriberi and (b)
Scurvy, Trans. Soc. Trop. Med. and Hyg., 1917, X, 141.
Chick, H., and SkÉäton, R. F.: (1) An Estimate of the Antiscorbutic Value of Milk in Infant
Feeding, Lancet, London, I, 1918, 1.
Chick, H., and SkÉäton, R. F.: (2) The Relative Content of Antiscorbutic Principle in Limes and
Lemons, Lancet, London, 1918, II, 735.
Chick, H., and RhoÇÉs, M.: An Investigation of the Antiscorbutic Value of the Raw Juices of
Root Vegetables, Lancet, London, 1918, II, 774.

CohÉn, B., and MÉnÇÉä, L. B.: (1) Diet and Roughage in Relation to the Experimental Scurvy of
Guinea-pigs, Proc. Soc. Exp. Biol. and Med., 1918, XV, 122.
CohÉn, B., and MÉnÇÉä, L. B.: (2) Experimental Scurvy of the Guinea-pig in Relation to the
Diet, Jour. Biol. Chem., 1918, XXXV, 427.
Comby, J.: (1) Twelve New Cases of Infantile Scurvy, Arch. de Méd. des Enfants, 1917, XX,
337.
Comby, J.: (2) Infantile Scurvy, Presse Médicale, 1918, XXVI, 480.
ConcÉtti, L.: Sopra due casi di morbo di Barlow, Rev. di clin. pediat., Firenze, 1909, VII, 225.
Coéäans, M.: (1) On the Etiology of Scurvy, Lancet, London, 1904, I, 1714.
Coéäans, M.: (2) On the Etiology of Scurvy, Jour. Trop. Med., London, 1904, VII, 99.
Coutts, F. J. H.: Upon an Inquiry as to Dried Milks, etc. Report to the Local Govt. Board, 1918,
New Series No. 116, 31.
Couvy: Une Épidémie de Beriberi et de Scorbut, Annales d’Hygiène de Méd. Coloniales, 1911,
XIV, 97.
CranÇaää , F. M.: Scurvy in an Infant of Six Weeks, Arch. of Pediat., 1899, XVI, 851.
CrockÉr , W., and Harrington, G. F.: Catalase and Oxidase Content of Seeds, Jour. Agricult.
Research, Wash., D. C., 1918, XV, 137.
Curran, J. O.: Observations on Scurvy, etc., The Dublin Quart. Jour. Med. Sciences, 1847, IV,
107.
CzÉrny A., and KÉääÉr, A.: Handbuch des Kindes Ernaerung, etc., Leipzig, 1907, II, 93.
Daräing , S. T.: The Pathologic Affinities of Beriberi and Scurvy, Jour. Am. Med. Assn., 1914,
LXIII, 1290.
DÉäf, E. M., and SkÉäton, R. F.: The Effect of Drying on the Antiscorbutic and Growth-
Promoting Properties of Cabbage, Biochem. Jour., 1918, XII, 448.
DÉäf, E. M., and TozÉr, F. M.: The Antiscorbutic and Growth-Promoting Properties of Raw and
Heated Cabbage, Biochem. Jour., 1918, XII, 416.
DÉäéÉch , M. A.: Le Scorbut pendant le Siège de Paris, Annales d’Hyg., 1871, XXXV, 2nd S.
Disèué, L.: Enstehung and Verlauf des Skorbuts im Jahre, 1916, Med. Klinik, 1918, XIV, 10.
DukÉ, W. W.: Pathogenesis of Purpura Hemorrhagica, Arch. Int. Med., 1912, X, 445.
DutchÉr, R. A.: Nature and Function of the Antineuritic Vitamine, Proc. Nat. Acad. of Sci.,
1920, VI, 10.
DykÉ, H. W.: An Outbreak of Scurvy in the South African Native Labour Corps, Lancet,
London, 1918, II, 513.
EÇÇy, W. H.: Further Observations on Pancreatic Vitamine, Proc. Soc. Exper. Biol. and Med.,
1917, XIV, 164.
EÇitoriaä: Deficiency Diseases in Vienna, Brit. Med. Jour., 1920, I, 477.
EÇwarÇs, C. R.: Peripheral Neuritis in Jamaica, Jour. Trop. Med. and Hyg., 1916, XIX, 53.

Eiàkman , C.: Eine beriberiaehnliche Krankheit der Huehner, Virchow’s Archiv., 1897, CXLVIII,
523.
Enright , J. I.: War Edema in Turkish Prisoners, Lancet, London, 1920, I, 314.
EéstÉin, A.: Ueber eine Auffaellige Haeufung der Barlow’schen Krankheit im den Kriegsjahren,
1917–1918, Jahrb. f. Kinderheilk, 1918, LXXXVIII, 237.
ErÇhÉim , J.: Ueber das Barlowherz, Wien. klin. Woch., 1918, 1293.
EschÉrich , T.: (1) Skorbut. Verhandl. d. Gesellsch. f. Kinderheilk., 1898, XV, 77.
EschÉrich , T.: (2) Zur Kenntnis der Unterschiede zwischen den natuerlichen und kuenstlichen
Ernaehrung des Saeuglings, Wien klin. Woch., 1900, XIII, 1185.
EssÉr: Blut-und Knochenmarksveraenderungen bei Ernaehrungsschaden, Verhandl. deutschen
Naturforsch. u. Aerzte, Abt. f. Innere Med., 1908, 86.
Faäk, K. G., McguirÉ , G., and Bäount, E.: The Oxidase, Peroxidase, Catalase and Amylase of
fresh and dehydrated vegetables, Jour. Biol. Chem., 1919, XXXVIII, 229.
FÉigÉnbaum, D.: Ein Beitrag zur Kenntnis der Rückenmarkblutungen beim Skorbut, Wien. klin.
Woch., 1917, XXX, 1455.
FifÉ, C. A.: Pathology of Infantile Scurvy, N. Y. Med Jour., 1910, XCI, 1322.
Fiäatow: Cited by M. Schubert, Beriberi und Skorbut, Deutsch. Arch. f. klin. Med., 1905,
LXXXVI, 79.
FinkÉästÉin , H.: Lehrbuch der Saeuglingsk., II, Berlin, 1912.
FischÉr , Th.: Zur Kenntnis der hereditaeren Syphilis, Muenchn. med. Woch., 1890, XXXVII,
621.
FoÉrstÉr , R.: Ein Fall von acute Rachitis, Jahrb. f. Kinderheilk, 1868, I, 444.
FraÉnkÉä , E.: Fortschritte a. d. Gebiete der Roentgenstrahlen, 1904, VII, Nos. 5 and 6; 1906,
X, No. 1; 1908, Ergaensungsbd., XVIII.
FrÉisÉ, E.: Der Alkoholextract aus Vegetabilien als Traeger. Barlowheilende Stoffe, Monatschr.
f. Kinderheilk, 1914, XII, 687.
FrÉuÇÉnbÉrg , E.: Beitrag zur Frage des Barlow-Schutzstoffes. Monatschr. f. Kinderheilk, 1914,
XIII, 141.
FrÉunÇ, G.: Zur Kenntnis der Barlow’schen Krankheit (Brust Kind) Arch. f. Klin. Med., 1905,
LXXXVI, 129.
FroÉäich , T.: Experimentelle Untersuchungen ueber den infantilen Skorbut, Ztschr. f. Hyg. u.
Infektionskrankh., 1912, LXXII, 155.
Fruitnight , J. H.: Infantile Scurvy, Especially its Differential Diagnosis, Arch. of Pediat., 1894,
XI, 486, 573.
FuÉrst, L.: Infantiler Scorbut oder Haemorrhagische Rhachitis, Berl. klin. Woch., 1895, XXXII,
389.
FuÉrst, V.: Weitere Beitraege zur Aetiologie des experimentellen Skorbuts des
Meerschweinchens, Ztschr. f. Hyg. u. Infektionskrankh. 1912, LXXII, 121.

Funk, C.: (1) On the Chemical Nature of the Substance which Cures Polyneuritis in Birds, Jour.
Physiol., 1911, XLIII, 395.
Funk, C.: (2) Die Vitamine, Wiesbaden, 1914, J. F. Bergman.
Funk, C., and Dougäas, M.: Studies on Beriberi, VIII, Jour. Physiol, 1914, XLVII, 475.
Funk, C., and von SchoÉnborn, E.: The Influence of a Vitamine Free Diet on the Carbohydrate
Metabolism, Jour. Physiol., 1914, XLVIII, 328.
GarroÇ, A. B.: On the Nature, Cause and Prevention of Scurvy, Month. Jour. Med. Sci., 1848,
Vol. VIII, 457.
GÉÉ: (1) On Osteal or Periosteal Cachexia, St. Bart. Hosp. Rep., 1881, XVII, 9.
GÉÉ: (1) On Osteal or Periosteal Cachexia, St. Bart. Hosp. Rep., 1881, Rep., 1889, XXV, 85.
GÉrstÉnbÉrgÉr , H. J.: Pathogenesis of Infantile Scurvy, an Hypothesis, Am. Jour. Med. Sci.,
1918, CLV, 253.
Gingui, F.: Riforma Med., 1918, XXXIV, 22.
GivÉns, M. H., and Hoffman , G. L.: Preliminary Observations on the Relation of Bacteria to
Experimental Scurvy in Guinea-pigs, Jour. Biol. Chem., 1920, XLI, 33.
GivÉns, M. H., and McCäugagÉ , H. B.: The Antiscorbutic Property of Fruits, Am. Jour. Dis. Child.,
1919, XVIII, 30.
Gäisson: Treatise on the Rickets, London, 1651.
GoäÇbÉrgÉr , J.: Studies on Pellagra, Hyg. Lab. Bull’s., 1914–1920.
GuÉrrÉro and Quinto: Cited by Vedder, Beriberi, p. 259.
HarÇÉn, A., and Ziäva, S. S.: (1) Note on the Etiology of Scurvy in Guinea-pigs, Biochem. Jour.,
1918, XII, 270.
HarÇÉn, A., and Ziäva, S. S.: (2) The Differential Behavior of the Antineuritic and Antiscorbutic
Factors Towards Adsorbents, Biochem. Jour., 1918, XII, 93.
HarÇÉn, A., and Ziäva, S. S.: (3) The Antiscorbutic Factor in Lemon Juice, Biochem. Jour., 1918,
XII, 259.
HarÇÉn, A., and Ziäva, S. S.: (4) Accessory Factors in the Nutrition of the Rat, Biochem. Jour.,
1918, XII, 408.
HarÇÉn, A., and Ziäva, S. S.: (5) An Investigation of Beer for Antineuritic and Antiscorbutic
Potency, Jour. of the Institute of Brewing, 1918, XXIV, 197.
HarÇÉn, A., and Ziäva, S. S.: (6) The Susceptibility of the Antiscorbutic Principle to Alkalinity,
Lancet, London, 1918, II, 320.
HarÇÉn, A., Ziäva, S. S., and Stiää, G. F.: Infantile Scurvy, Antiscorbutic Factor of Lemon Juice
in Treatment, Lancet, London, 1919, I, 17.
Haräan, G. P.: Land Scurvy in England, Brit. Med. Jour., 1917, II, 46.
Hart, C.: Der Skorbut der kleinen Kinder (Moeller-Barlow’sche Krankheit) Nach
Experimentellen Untersuchungen, Jahrb. f. Kinderheilk, 1912, LXXVI, 507.
Hart, C., and LÉssing, O.: Der Skorbut der Kleinen Kinder, Stuttgart, 1913, Ferdinand Enke.

Welcome to our website – the perfect destination for book lovers and
knowledge seekers. We believe that every book holds a new world,
offering opportunities for learning, discovery, and personal growth.
That’s why we are dedicated to bringing you a diverse collection of
books, ranging from classic literature and specialized publications to
self-development guides and children's books.
More than just a book-buying platform, we strive to be a bridge
connecting you with timeless cultural and intellectual values. With an
elegant, user-friendly interface and a smart search system, you can
quickly find the books that best suit your interests. Additionally,
our special promotions and home delivery services help you save time
and fully enjoy the joy of reading.
Join us on a journey of knowledge exploration, passion nurturing, and
personal growth every day!
ebookbell.com

Architecting Dependable Systems Vi 1st Edition Ricardo Jimenezperis

About This Presentation

Slide Content

Tags

Categories

Download

Quick Actions

Statistics

Related Slideshows

Architecting Dependable Systems Vi 1st Edition Ricardo Jimenezperis

About This Presentation

Slide Content

Slide 1

Slide 2

Slide 3

Slide 5

Slide 6

Slide 7

Slide 8

Slide 9

Slide 10

Slide 11

Slide 12

Slide 13

Slide 14

Slide 15

Slide 16

Slide 17

Slide 18

Slide 19

Slide 20

Slide 21

Slide 22

Slide 23

Slide 24

Slide 25

Slide 26

Slide 27

Slide 28

Slide 29

Slide 30

Slide 31

Slide 32

Slide 33

Slide 34

Slide 35

Slide 36

Slide 37

Slide 38

Slide 39

Slide 40

Slide 41

Slide 42

Slide 43

Slide 44

Slide 45

Slide 46

Slide 47

Slide 48

Slide 49

Slide 50

Slide 51

Slide 52

Slide 53

Slide 54

Slide 55

Slide 56

Slide 57

Slide 58

Slide 59

Slide 60

Slide 61

Slide 62

Slide 63

Slide 64

Slide 65

Slide 66

Slide 67

Slide 68

Slide 69

Slide 70

Slide 71

Slide 72

Slide 73

Slide 74

Slide 75

Slide 76

Slide 77

Slide 78